Incomplete sanitization of upload file name.

[mt8.biz]

The newline code is replaced with "-" in sanitize_file_name, but other control characters have not been sanitized.

For example, ^ P ( \ x10 )

This allows uploading with the control characters included in the file name.

# ls -la
-rw-r--r--  1 root     root     19058 Jun 14 04:21 ???wapuu_escape-150x150.png
-rw-r--r--  1 root     root     41163 Jun 14 04:21 ???wapuu_escape-297x300.png
-rw-r--r--  1 root     root     31022 Jun 14 04:21 ???wapuu_escape.png

After applying the patch:

# ls -la
-rw-r--r-- 1 www-data www-data 19058 Jun 14 04:27 wapuu_escape-150x150.png
-rw-r--r-- 1 www-data www-data 41163 Jun 14 04:27 wapuu_escape-297x300.png
-rw-r--r-- 1 www-data www-data 31022 Jun 14 04:27 wapuu_escape.png

Attach a test file.

[kirasong]

@SergeyBiryukov Are you still looking to land this for 5.3?

If not, will have to move to Future Release or 5.4, depending on your preferences, before 5.3 beta.

[kirasong]

As 5.3 beta is about to ship, going to go ahead and move this to Future Release.

Of course, feel free to milestone differently as you'd like.

[mt8.biz]

@SergeyBiryukov 
What do you think of this?

Although control characters are rarely included in file names, it is best to remove them.

Thank you