	public function post_prop () {
		$file = urldecode (join ('/', func_get_args ()));
		if (! FileManager::verify_file ($file)) {
			return $this->error (__ ('Invalid file name'));
		}
		
		// handle multiple properties at once
		if (isset ($_POST['props'])) {
			if (! is_array ($_POST['props'])) {
				return $this->error (__ ('Invalid properties'));
			}
			
			foreach ($_POST['props'] as $k => $v) {
				if (FileManager::prop ($file, $k, $v) === false) {
					return $this->error (__ ('Error saving properties.'));
				}
			}
			
			return array (
				'file' => $file,
				'props' => $_POST['props'],
				'msg' => __ ('Properties saved.')
			);
		}
		
		// handle a single property
		if (! isset ($_POST['prop'])) {
			return $this->error (__ ('Missing property name'));
		}
		if (isset ($_POST['value'])) {
			// update and fetch
			$res = FileManager::prop ($file, $_POST['prop'], $_POST['value']);
		} else {
			// fetch
			$res = FileManager::prop ($file, $_POST['prop']);
		}
		return array (
			'file' => $file,
			'prop' => $_POST['prop'],
			'value' => $res,
			'msg' => __ ('Properties saved.')
		);
	}
The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.