fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-05-04 17:44:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

Fix incorrect encoding of filenames with single quotes

Browse source
This commit is contained in:
Kijin Sung 2024-10-09 15:37:22 +09:00
parent 0a92627c8a
commit 44608bbe90
2 changed files with 7 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

6
common/framework/filters/FilenameFilter.php
View file

@ -15,6 +15,9 @@ class FilenameFilter
*/ */
public static function clean(string $filename): string public static function clean(string $filename): string
{ {
// Clean up unnecessary encodings.
$filename = strtr($filename, ['&' => '&', ''' => "'"]);
// Replace dangerous characters with safe alternatives, maintaining meaning as much as possible. // Replace dangerous characters with safe alternatives, maintaining meaning as much as possible.
$illegal = array('\\', '/', '<', '>', '{', '}', ':', ';', '|', '"', '~', '`', '$', '%', '^', '*', '?'); $illegal = array('\\', '/', '<', '>', '{', '}', ':', ';', '|', '"', '~', '`', '$', '%', '^', '*', '?');
$replace = array('', '', '(', ')', '(', ')', '_', ',', '_', '', '_', '\'', '_', '_', '_', '', ''); $replace = array('', '', '(', ')', '(', ')', '_', ',', '_', '', '_', '\'', '_', '_', '_', '', '');
@ -31,9 +34,6 @@ class FilenameFilter
$filename = preg_replace('/__+/', '_', $filename); $filename = preg_replace('/__+/', '_', $filename);
$filename = preg_replace('/\.\.+/', '.', $filename); $filename = preg_replace('/\.\.+/', '.', $filename);
// Clean up unnecessary encodings.
$filename = strtr($filename, array('&amp;' => '&'));
// Change .php files to .phps to make them non-executable. // Change .php files to .phps to make them non-executable.
if (strtolower(substr($filename, strlen($filename) - 4)) === '.php') if (strtolower(substr($filename, strlen($filename) - 4)) === '.php')
{ {

8
common/js/plugins/jquery.fileupload/js/main.js
View file

@ -353,12 +353,12 @@
unselectNonImageFiles: function() {}, unselectNonImageFiles: function() {},
generateHtml: function($container, file) { generateHtml: function($container, file) {
var filename = String(file.source_filename); var filename = String(file.source_filename).escape();
var html = ''; var html = '';
var data = $container.data(); var data = $container.data();
if (filename.match(/\.(gif|jpe?g|png|webp)$/i)) { if (filename.match(/\.(gif|jpe?g|png|webp)$/i)) {
html = '<img src="' + file.download_url + '" alt="' + file.source_filename + '"' html = '<img src="' + file.download_url + '" alt="' + filename + '"'
+ ' editor_component="image_link" data-file-srl="' + file.file_srl + '" />'; + ' editor_component="image_link" data-file-srl="' + file.file_srl + '" />';
} }
else if (filename.match(/\.(mp3|wav|ogg|flac|aac)$/i)) { else if (filename.match(/\.(mp3|wav|ogg|flac|aac)$/i)) {
@ -388,7 +388,7 @@
} }
if (html === '') { if (html === '') {
html += '<a href="' + file.download_url + '" data-file-srl="' + file.file_srl + '">' + file.source_filename + '</a>\n'; html += '<a href="' + file.download_url + '" data-file-srl="' + file.file_srl + '">' + filename + '</a>\n';
} }
return html; return html;
@ -515,7 +515,7 @@
$container.data(data); $container.data(data);
file.thumbnail_url = file.download_url; file.thumbnail_url = file.download_url;
file.source_filename = file.source_filename.replace("&amp;", "&"); file.source_filename = file.source_filename.replace("&amp;", "&").replace("&#039;", "'");
if(file.thumbnail_filename) { if(file.thumbnail_filename) {
file.thumbnail_url = file.thumbnail_filename; file.thumbnail_url = file.thumbnail_filename;