Changeset 48596

Timestamp:

07/24/2020 12:57:26 AM (4 years ago)

Author:

SergeyBiryukov

Message:

Media: Filter out a few more special characters in sanitize_file_name().

Props audrasjb.
Fixes #50231.

Location:

trunk

Files:

• src/wp-includes/formatting.php (modified) (1 diff)
• tests/phpunit/tests/formatting/SanitizeFileName.php (modified) (1 diff)

trunk/src/wp-includes/formatting.php

@@ -1986 +1986 @@
 function sanitize_file_name( $filename ) {
     $filename_raw  = $filename;
-    $special_chars = array( '?', '[', ']', '/', '\\', '=', '<', '>', ':', ';', ',', "'", '"', '&', '$', '#', '*', '(', ')', '|', '~', '`', '!', '{', '}', '%', '+', chr( 0 ) );
+    $special_chars = array( '?', '[', ']', '/', '\\', '=', '<', '>', ':', ';', ',', "'", '"', '&', '$', '#', '*', '(', ')', '|', '~', '`', '!', '{', '}', '%', '+', '’', '«', '»', '”', '“', chr( 0 ) );
 
     // Check for support for utf8 in the installed PCRE library once and store the result in a static.

trunk/tests/phpunit/tests/formatting/SanitizeFileName.php

@@ -12 +12 @@
 
     function test_removes_special_chars() {
-        $special_chars = array( '?', '[', ']', '/', '\\', '=', '<', '>', ':', ';', ',', "'", '"', '&', '$', '#', '*', '(', ')', '|', '~', '`', '!', '{', '}', '%', '+', chr( 0 ) );
+        $special_chars = array( '?', '[', ']', '/', '\\', '=', '<', '>', ':', ';', ',', "'", '"', '&', '$', '#', '*', '(', ')', '|', '~', '`', '!', '{', '}', '%', '+', '’', '«', '»', '”', '“', chr( 0 ) );
         $string        = 'test';
         foreach ( $special_chars as $char ) {