  def drop_file
    Log.add_info(request, '')   # Not to show passwords.

    return unless request.post?

    if params[:file].nil? or params[:file].size <= 0
      render(:text => '')
      return
    end

    my_folder = @login_user.get_my_folder
    if my_folder.nil?
      render(:text => 'ERROR:' + t('folder.cannot_find_my_folder'))
      return
    end

    original_filename = params[:file].original_filename
    title = ApplicationHelper.take_ncols(File.basename(original_filename, '.*'), 60, nil)

    item = Item.new_info(my_folder.id)
    item.title = title
    item.user_id = @login_user.id
    item.save!

    params[:title] ||= title
    attachment = Attachment.create(params, item, 0)

    toy = Toy.new
    toy.user_id = @login_user.id
    toy.xtype = Toy::XTYPE_ITEM
    toy.target_id = item.id
    toy.x, toy.y = DesktopsHelper.find_empty_block(@login_user)
    toy.save!

    render(:text => t('file.uploaded'))
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.