Item12640: don't screw up filenames

pencil
Priority: Enhancement
Current State: Closed
Released In: n/a
Target Release:
Applies To: Extension
Component: XSendFileContrib
Branches: trunk
Reported By: MichaelDaum
Waiting For:
Last Change By: MichaelDaum
Calling

$fileName = Foswiki::Sandbox::untaint($fileName, \&Foswiki::Sandbox::validateAttachmentName);

will rewrite the fileName in a rather unexpected way: it removes all suspicious characters - like a space. Uploading it to foswiki these chars not passing the {NameFilter} as configured in LocalSite.cfg will be rewritten using underscores. Not so Foswiki::Sandbox::validateAttachmentName ... which renders it useless for xsendfile (and viewfile actually too).

-- MichaelDaum - 06 Nov 2013

 
Topic revision: r4 - 06 Nov 2013, MichaelDaum
The copyright of the content on this website is held by the contributing authors, except where stated elsewhere. See Copyright Statement. Creative Commons License    Legal Imprint    Privacy Policy