filenames' parsing bug - Githubissues

MasterEx / myloader

a simple PHP file uploader

http://ammar.gr/myloader

11 stars 1 forks source link

filenames' parsing bug #4

Closed MasterEx closed 14 years ago

MasterEx commented 14 years ago

When filenames contain special characters such as (,),! e.t.c. the parsing fails. This leads to unreachable files and specifically returns a "Your link is invalid , or maybe the file expired.. " warning page.

AmmarkoV commented 14 years ago

Fix Proposal : Add filtering after submiting the file to change ! , ( ) to underscores , with the current filename scheme it is not safe to keep this characters!

MasterEx commented 14 years ago

we could base64 these characters or something and decode them in [v]file.php when serving them, somehow

AmmarkoV commented 14 years ago

this could work , the filename will be very long though..!

MasterEx commented 14 years ago

yes and the files won't be searchable through firefox awesomebar :/ However I don't feel comfortable about changing the original file name :(

AmmarkoV commented 14 years ago

Will just apply the same filter on the uploaded filename and everything will be fine :)

MasterEx commented 14 years ago

It seems that the particular character that isn't parsed correctly is &

AmmarkoV commented 14 years ago

& in HTML is an escape character..! See http://www.ascii.cl/htmlcodes.htm

MasterEx commented 14 years ago

OK, the problem is caused because [v]file.php GETS the file name that contains the & character. So when the ServeFile($_GET['i']); is called everything after & (including &) is ignored.

MasterEx commented 14 years ago

I think I fixed it :)

AmmarkoV commented 14 years ago

looks nice :)