 +        }
 +      }
 +    }
++
++    ######
++    # now we have unarchived everyting to TMPDIR, so lets check if it is valid
++    if {$file_invalid == 0} {
++      if {[file exists "$TMPDIR/new_firmware.ext4"] != 1 && [file exists "$TMPDIR/new_firmware.img"] != 1} {
++        # check if there are checksum files in TMPDIR and if so check the checksum first
++
++        # check for sha256 checksums
++        foreach chk_file [glob -nocomplain "$TMPDIR/*.sha256"] {
++          set file_invalid [catch {exec /bin/sh -c "cd $TMPDIR; /usr/bin/sha256sum -sc $chk_file"} result]
++          if {$file_invalid != 0} {
++            break
++          }
++        }
++
++        # check for md5 checksums
++        foreach chk_file [glob -nocomplain "$TMPDIR/*.md5"] {
++          set file_invalid [catch {exec /bin/sh -c "cd $TMPDIR; /usr/bin/md5sum -sc $chk_file"} result]
++          if {$file_invalid != 0} {
++            break
++          }
++        }
++
++        # everything seems to be fine with the uploaded file so lets
++        # do the final check
++        if {$file_invalid == 0} {
++          # if no *.img exists we have to check for "update_script"
++          if {[glob -nocomplain "$TMPDIR/*.img"] == ""} {
++            if {[file exists "$TMPDIR/update_script"] != 1} {
++              set file_invalid 1
++            }
++          }
++        }
++      }
++    }
  
 -    # check if the uploaded file looks like a firmware file
 -    set file_valid 0

-    if {$file_valid} {
-      file rename -force -- [lindex $firmware_file 0] "/usr/local/tmp/new_firmware.tar.gz"
-      #set action "firmware_update_confirm"
+    ######
+    # now we have unarchived everyting to TMPDIR, so lets check if it is valid
+    if {$file_invalid == 0} {
+      if {[file exists "$TMPDIR/new_firmware.ext4"] != 1 && [file exists "$TMPDIR/new_firmware.img"] != 1} {
+        # check if there are checksum files in TMPDIR and if so check the checksum first
+
+        # check for sha256 checksums
+        foreach chk_file [glob -nocomplain "$TMPDIR/*.sha256"] {
+          set file_invalid [catch {exec /bin/sh -c "cd $TMPDIR; /usr/bin/sha256sum -sc $chk_file"} result]
+          if {$file_invalid != 0} {
+            break
+          }
+        }
+
+        # check for md5 checksums
+        foreach chk_file [glob -nocomplain "$TMPDIR/*.md5"] {
+          set file_invalid [catch {exec /bin/sh -c "cd $TMPDIR; /usr/bin/md5sum -sc $chk_file"} result]
+          if {$file_invalid != 0} {
+            break
+          }
+        }
+
+        # everything seems to be fine with the uploaded file so lets
+        # do the final check
+        if {$file_invalid == 0} {
+          # if no *.img exists we have to check for "update_script"
+          if {[glob -nocomplain "$TMPDIR/*.img"] == ""} {
+            if {[file exists "$TMPDIR/update_script"] != 1} {
+              set file_invalid 1
+            }
+          }
+        }
+      }
+    }
+
+    #
+    # test if the above checks were successfull or not
+    #
+    if {$file_invalid == 0} {
+      catch { exec ln -sf $TMPDIR /usr/local/tmp/new_firmware }
       set action "acceptEula"
     } else {
-        file delete -force -- [lindex $firmware_file 0]

-  catch { exec /bin/sh -c "rm -f /usr/local/tmp/new_firmware.tar.gz" }
-  catch { exec /bin/sh -c "rm -f /usr/local/tmp/EULA.*" }
+  global env filename
+  catch { exec /bin/sh -c "rm -rf `readlink /usr/local/.firmwareUpdate` /usr/local/.firmwareUpdate" }
   cgi_javascript {
     puts "var url = \"$env(SCRIPT_NAME)?sid=\" + SessionId;"
     puts {
