Changeset 55209

Timestamp:

02/03/2023 12:46:18 PM (22 months ago)

Author:

audrasjb

Message:

Media: Replace consecutive periods in sanitize_file_name().

On some servers, consecutive periods in a filename can cause a 403 Forbidden response.
This changeset replaces consecutive periods with a single period, and adds related unit tests.

Props ArtZ91, costdev, SergeyBiryukov, arthurshlain, mukesh27.
Fixes #57242.

Location:

trunk

Files:

• src/wp-includes/formatting.php (modified) (1 diff)
• tests/phpunit/tests/formatting/sanitizeFileName.php (modified) (1 diff)
• tests/phpunit/tests/functions.php (modified) (1 diff)

trunk/src/wp-includes/formatting.php

@@ -2048 +2048 @@
     $filename = str_replace( $special_chars, '', $filename );
     $filename = str_replace( array( '%20', '+' ), '-', $filename );
+    $filename = preg_replace( '/\.{2,}/', '.', $filename );
     $filename = preg_replace( '/[\r\n\t -]+/', '-', $filename );
     $filename = trim( $filename, '.-_' );

trunk/tests/phpunit/tests/formatting/sanitizeFileName.php

@@ -96 +96 @@
         );
     }
+
+    /**
+     * Tests that sanitize_file_name() replaces consecutive periods
+     * with a single period.
+     *
+     * @ticket 57242
+     *
+     * @dataProvider data_sanitize_file_name_should_replace_consecutive_periods_with_a_single_period
+     *
+     * @param string $filename A filename with consecutive periods.
+     * @param string $expected The expected filename after sanitization.
+     */
+    public function test_sanitize_file_name_should_replace_consecutive_periods_with_a_single_period( $filename, $expected ) {
+        $this->assertSame( $expected, sanitize_file_name( $filename ) );
+    }
+
+    /**
+     * Data provider for test_sanitize_file_name_should_replace_consecutive_periods_with_a_single_period().
+     *
+     * @return array[]
+     */
+    public function data_sanitize_file_name_should_replace_consecutive_periods_with_a_single_period() {
+        return array(
+            'consecutive periods at the start'         => array(
+                'filename' => '...filename.png',
+                'expected' => 'filename.png',
+            ),
+            'consecutive periods in the middle'        => array(
+                'filename' => 'file.......name.png',
+                'expected' => 'file.name_.png',
+            ),
+            'consecutive periods before the extension' => array(
+                'filename' => 'filename....png',
+                'expected' => 'filename.png',
+            ),
+            'consecutive periods after the extension'  => array(
+                'filename' => 'filename.png...',
+                'expected' => 'filename.png',
+            ),
+            'consecutive periods at the start, middle, before, after the extension' => array(
+                'filename' => '.....file....name...png......',
+                'expected' => 'file.name_.png',
+            ),
+            'consecutive periods and no extension'     => array(
+                'filename' => 'filename...',
+                'expected' => 'filename',
+            ),
+        );
+    }
 }

trunk/tests/phpunit/tests/functions.php

@@ -259 +259 @@
 
         // Test crazy name (useful for regression tests).
-        $this->assertSame( '12af34567890@..^_qwerty-fghjkl-zx.png', wp_unique_filename( $testdir, '12%af34567890#~!@#$..%^&*()|_+qwerty  fgh`jkl zx<>?:"{}[]="\'/?.png' ), 'Failed crazy file name' );
+        $this->assertSame( '12af34567890@.^_qwerty-fghjkl-zx.png', wp_unique_filename( $testdir, '12%af34567890#~!@#$..%^&*()|_+qwerty  fgh`jkl zx<>?:"{}[]="\'/?.png' ), 'Failed crazy file name' );
 
         // Test slashes in names.