Ticket #44547: 44547.patch

src/wp-admin/includes/file.php

@@ -824 +824 @@
                 return call_user_func_array( $upload_error_handler, array( &$file, $uploads['error'] ) );
         }
 
-        $filename = wp_unique_filename( $uploads['path'], $file['name'], $unique_filename_callback );
+        $tmp_file_name = $file['name'];
+        $ext           = pathinfo( $tmp_file_name, PATHINFO_EXTENSION );
+        $name          = wp_basename( $tmp_file_name, ".$ext" );
+
+        // Change file name to be hashed if it contains multi-byte chars.
+        if ( ! is_ascii_text( $name ) ) {
+                $tmp_file_name = md5( $name ) . ".$ext";
+        }
+
+        $filename = wp_unique_filename( $uploads['path'], $tmp_file_name, $unique_filename_callback );
 
         // Move the file to the uploads dir.
         $new_file = $uploads['path'] . "/$filename";

src/wp-includes/formatting.php

@@ -5057 +5057 @@
         return apply_filters( 'sanitize_text_field', $filtered, $str );
 }
 
+/**
+ * Check if it has only ASCII characters or not.
+ *
+ * @since 5.0.0
+ * @param string $str Strings that may contain none-ASCII chars.
+ * @return bool Return true if $str is ASCII text.
+ */
+function is_ascii_text( $str ) {
+        if ( preg_match( '/^[\\x{0000}-\\x{007F}]+$/u', $str, $match ) ) {
+                return true;
+        } else {
+                return false;
+        }
+}
+
 /**
  * Sanitizes a multiline string from user input or from the database.
  *

new file tests/phpunit/tests/formatting/FileName.php

@@ +1 @@
+<?php
+
+/**
+ * @group formatting
+ */
+class Tests_Formatting_FileName extends WP_UnitTestCase {
+        /**
+         * Check if it contains none-ASCII character or not.
+         */
+        function test_contains_ascii_chars() {
+                $ascii_text = 'Welcome to WordPress.';
+                $this->assertTrue( is_ascii_text( $ascii_text ) );
+
+                $none_ascii_text = 'WordPressへようこそ';
+                $this->assertFalse( is_ascii_text( $none_ascii_text ) );
+        }
+}