Changeset 55209

Timestamp:

02/03/2023 12:46:18 PM (4 years ago)

Author:

audrasjb

Message:

Media: Replace consecutive periods in sanitize_file_name().

On some servers, consecutive periods in a filename can cause a 403 Forbidden response.
This changeset replaces consecutive periods with a single period, and adds related unit tests.

Props ArtZ91, costdev, SergeyBiryukov, arthurshlain, mukesh27.
Fixes #57242.

Location:

trunk

Files:

• src/wp-includes/formatting.php (modified) (1 diff)
• tests/phpunit/tests/formatting/sanitizeFileName.php (modified) (1 diff)
• tests/phpunit/tests/functions.php (modified) (1 diff)

trunk/src/wp-includes/formatting.php

@@ -2048 +2048 @@
         $filename = str_replace( $special_chars, '', $filename );
         $filename = str_replace( array( '%20', '+' ), '-', $filename );
+        $filename = preg_replace( '/\.{2,}/', '.', $filename );
         $filename = preg_replace( '/[\r\n\t -]+/', '-', $filename );
         $filename = trim( $filename, '.-_' );

trunk/tests/phpunit/tests/formatting/sanitizeFileName.php

@@ -96 +96 @@
                 );
         }
+
+        /**
+         * Tests that sanitize_file_name() replaces consecutive periods
+         * with a single period.
+         *
+         * @ticket 57242
+         *
+         * @dataProvider data_sanitize_file_name_should_replace_consecutive_periods_with_a_single_period
+         *
+         * @param string $filename A filename with consecutive periods.
+         * @param string $expected The expected filename after sanitization.
+         */
+        public function test_sanitize_file_name_should_replace_consecutive_periods_with_a_single_period( $filename, $expected ) {
+                $this->assertSame( $expected, sanitize_file_name( $filename ) );
+        }
+
+        /**
+         * Data provider for test_sanitize_file_name_should_replace_consecutive_periods_with_a_single_period().
+         *
+         * @return array[]
+         */
+        public function data_sanitize_file_name_should_replace_consecutive_periods_with_a_single_period() {
+                return array(
+                        'consecutive periods at the start'         => array(
+                                'filename' => '...filename.png',
+                                'expected' => 'filename.png',
+                        ),
+                        'consecutive periods in the middle'        => array(
+                                'filename' => 'file.......name.png',
+                                'expected' => 'file.name_.png',
+                        ),
+                        'consecutive periods before the extension' => array(
+                                'filename' => 'filename....png',
+                                'expected' => 'filename.png',
+                        ),
+                        'consecutive periods after the extension'  => array(
+                                'filename' => 'filename.png...',
+                                'expected' => 'filename.png',
+                        ),
+                        'consecutive periods at the start, middle, before, after the extension' => array(
+                                'filename' => '.....file....name...png......',
+                                'expected' => 'file.name_.png',
+                        ),
+                        'consecutive periods and no extension'     => array(
+                                'filename' => 'filename...',
+                                'expected' => 'filename',
+                        ),
+                );
+        }
 }

trunk/tests/phpunit/tests/functions.php

@@ -259 +259 @@
 
                 // Test crazy name (useful for regression tests).
-                $this->assertSame( '12af34567890@..^_qwerty-fghjkl-zx.png', wp_unique_filename( $testdir, '12%af34567890#~!@#$..%^&*()|_+qwerty  fgh`jkl zx<>?:"{}[]="\'/?.png' ), 'Failed crazy file name' );
+                $this->assertSame( '12af34567890@.^_qwerty-fghjkl-zx.png', wp_unique_filename( $testdir, '12%af34567890#~!@#$..%^&*()|_+qwerty  fgh`jkl zx<>?:"{}[]="\'/?.png' ), 'Failed crazy file name' );
 
                 // Test slashes in names.