WordPress.org

Make WordPress Core

Ticket #16330: 16330.2.diff

File 16330.2.diff, 2.0 KB (added by kawauso, 8 years ago)

% and + to sanitize_file_name(), urldecode() sideloaded filenames

  • wp-admin/includes/file.php

     
    461461
    462462        $filename = wp_unique_filename( $uploads['path'], $file['name'], $unique_filename_callback );
    463463
    464         // Strip the query strings.
    465         $filename = str_replace('?','-', $filename);
    466         $filename = str_replace('&','-', $filename);
    467 
    468464        // Move the file to the uploads dir
    469465        $new_file = $uploads['path'] . "/$filename";
    470466        if ( false === @ rename( $file['tmp_name'], $new_file ) ) {
  • wp-admin/includes/media.php

     
    588588                // Set variables for storage
    589589                // fix file filename for query strings
    590590                preg_match('/[^\?]+\.(jpg|JPG|jpe|JPE|jpeg|JPEG|gif|GIF|png|PNG)/', $file, $matches);
    591                 $file_array['name'] = basename($matches[0]);
     591                $file_array['name'] = urldecode( basename( $matches[0] ) );
    592592                $file_array['tmp_name'] = $tmp;
    593593
    594594                // If error storing temporarily, unlink
  • wp-includes/formatting.php

     
    714714 */
    715715function sanitize_file_name( $filename ) {
    716716        $filename_raw = $filename;
    717         $special_chars = array("?", "[", "]", "/", "\\", "=", "<", ">", ":", ";", ",", "'", "\"", "&", "$", "#", "*", "(", ")", "|", "~", "`", "!", "{", "}", chr(0));
     717        $special_chars = array("?", "[", "]", "/", "\\", "=", "<", ">", ":", ";", ",", "'", "\"", "&", "$", "#", "*", "(", ")", "|", "~", "`", "!", "{", "}", "%", "+", chr(0));
    718718        $special_chars = apply_filters('sanitize_file_name_chars', $special_chars, $filename_raw);
    719719        $filename = str_replace($special_chars, '', $filename);
    720720        $filename = preg_replace('/[\s-]+/', '-', $filename);