Illegal characters in file names

rbl · December 28th, 2004, 06:45 PM

Hi!
I've just found out that Gallery accepts files with all sorts of characters in the file name.
A user uploaded an image called moinho_#2.jpg and the image is broken because # are illegal.
Further tests show that it accepts almost every character you feed it.

A simple solution would be check the file name on upload and replace everything other than a-z, A-Z, 0-9, - and _ for underscores.

While this might not be such a big issue in english based sites, it is a very big problem with other languages like Portuguese, French, German, etc.

Thanks!
Ricardo

rbl · December 30th, 2004, 01:01 PM

Brian, here's a possible solution for this issue. Code is ugly but it works. There are a couple of issues that would be great if you could manage to get them to work.

Open your functions_gallery_imageedit.php and change your function fetch_image_info to resemble the code bellow. Bold lines are the same, it only changes in between them.

This takes all non-alphanumerical character from the uploaded file name and replaces it with an underscore.
Because the resulting name could be something like "my________dog_____.jpg", I add a line to replace every multiple instance of underscores for a single one like "my_dog_.jpg". It's the commented line.

But when I upload the same image again, the random suffix rename kicks in and I end up with a broken image because the file is saved to disc as "my_dog__941530.jpg" (correct double underscore after dog) but in the database is "my_dog_941530.jpg".

What's wrong??

Code:

Content visible to verified customers only.

Reynaldo · December 31st, 2004, 06:20 PM

RBL:

I just barely took a look at function fetch_image_info so maybe I'm wrong....

but... I think you should apply all your filters and replacements after this line:

270 $imginfo['saveas'] = $imginfo['filename'];

Remember, you want to save the file with restricted chars (a-zA-Z0-9_), NOT TO OPEN it. I mean, you won't change the name of the file uploaded to the temp folder, you just want to change the filename that is going to be saved.

I'me leaving right now, but as soon as I return I'll paste the corrected modification (if any).

rbl · January 1st, 2005, 06:13 PM

Thanks Reynaldo!
I can't recall right now but I think I chose that location because the save process doesn't handle the file directly but through this function.
If you can improve (or correct) it, I appreciate it.
I posted this because I need a fix for this problem right now (can't wait for Brian to release the next RC) and I thought others might need it as well.

Reynaldo · January 1st, 2005, 10:09 PM

rbl:

I took a closer look now and this can be achieved quite easily:

Open file /forums/includes/functions_gallery_imageedit.php
Inside this file somewhere around line 246 look for this

Code:

Content visible to verified customers only.

Replace with this:

Code:

Content visible to verified customers only.

Save your file and throw some weird image names to test it. It replaces every character that is not alphanumeric, dash, underscore or the dot, with one underscore.

Test it and let me know. I tried it with an imagename like this:
Az%20ñame cósa_ivclrd01.jpg
and the result was:
az_20_ame_c_sa_ivclrd01.jpg

rbl · January 2nd, 2005, 08:44 PM

Hi Reynaldo!
I've tried your solution but it didn't work. Don't know why!
Strangely, on my site, the name is entirely replaced by an underscore.

I posted an image named moinho 3 é verão #"$%.jpg and it was renamed _.jpg =)

Reynaldo · January 3rd, 2005, 04:30 AM

rbl:

Since I made the changes, a lot of pictures have been uploaded to my site and it works like a charm.

Are you sure you applied the modification correctly? Maybe your mods are still in place.

Reynaldo · January 3rd, 2005, 04:34 AM

RBL:

Just to be sure, I took a look again at my modified functions_gallery_imageedit.php file, the code is exactly as I posted it.

As a confirmation, here is the complete code for the function fetch_image_info():

Code:

Content visible to verified customers only.

rbl · January 4th, 2005, 06:46 PM

Reynaldo, sorry for the late reply but between a nasty cold and the vB 3.0.4 upgrade, there wasn't much time left.
I had already checked my code and it's fine, my hack is gone and yours is in place, the rest of the code is clean. Don't understand.
Your code looks pretty standard but I'm checking my php version... get back to you later.