There are a couple of security issues related to file names

1. Prevent renaming foo.jpg to foo.php.jpg. See file_munge_filename

2. Forbid some characters(combos): /, \, :, ../, dots at the beginning/end, invalid chars in some operating systems(*?"<>), null

3. Limit filename length

4. Check existence of the new name (on php side)

Comments

ufku created an issue. See original summary.

ufku’s picture

Issue summary: View changes
ufku’s picture

Issue summary: View changes
zulljin’s picture

Assigned: Unassigned » zulljin
zulljin’s picture

Thank for reporting.

  • Zulljin committed 6f12e42 on 8.x-1.x
    Issue #2886549 by ufku: File name validation
    

  • Zulljin committed 240ed97 on 8.x-1.x
    Issue #2886549 by ufku: File name validation
    
zulljin’s picture

Status: Active » Fixed

Issue fixed on dev and alpha5 release.

zulljin’s picture

Status: Fixed » Closed (fixed)