TPS
/
ORIENT
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Relax restrictions on MediaLibrary filenames (#3778) 

Fixes #3741. Credit to @chrisbethelepb
This commit is contained in:
chrisbethelepb 2018-09-12 13:37:21 -04:00 committed by Luke Towers
parent cf9d487b30
commit 0ffdbc5efd
2 changed files with 24 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
modules/system/classes/MediaLibrary.php
View File

@ -475,7 +475,23 @@ class MediaLibrary
/*
* Validate folder names
*/
if (!preg_match('/^[\w@\.\s_\-\/]+$/iu', $path)) {
$regexWhitelist = [
'\w', // any word character
preg_quote('@', '/'),
preg_quote('.', '/'),
'\s', // whitespace character
preg_quote('-', '/'),
preg_quote('_', '/'),
preg_quote('/', '/'),
preg_quote('(', '/'),
preg_quote(')', '/'),
preg_quote('[', '/'),
preg_quote(']', '/'),
preg_quote(',', '/'),
preg_quote('=', '/'),
];
if (!preg_match('/^[' . implode('', $regexWhitelist) . ']+$/iu', $path)) {
throw new ApplicationException(Lang::get('system::lang.media.invalid_path', compact('path')));
}

4
tests/unit/system/classes/MediaLibraryTest.php
View File

@ -33,6 +33,10 @@ class MediaLibraryTest extends TestCase // @codingStandardsIgnoreLine
['file.ext'],
['file..ext'],
['file...ext'],
['one,two.ext'],
['one(two)[].ext'],
['one=(two)[].ext'],
['one_(two)[].ext'],
];
}