search

stephenmcd / filebrowser-safe

File manager for Mezzanine
Other
41 stars 104 forks source link

modify FOLDER_REGEX to include dotted directory paths #112

Open shiplet opened 6 years ago

shiplet commented 6 years ago

Ran into an issue where renaming Media Library files failed on file paths with dotted directory names: e.g. /var/www/sites/sitename.com/....

Propose including \. in the default FOLDER_REGEX to account for this fairly common naming schema out of the box.

stephenmcd commented 6 years ago

I haven't confirmed it, but I think this would allow admin users to traverse parent directories which could turn into a security issue.

shiplet commented 6 years ago

Good point. So far being able to overwrite the FILEBROWSER_FOLDER_REGEX in settings.py is sufficient for us, maybe it'd be worth adding a note to the Media Library docs?