search

terminal42 / contao-mp_forms

Real step separation in the form generator of the Contao Open Source CMS
25 stars 13 forks source link

Show original filename in "##mp_forms_summary##" token. #51

Closed taca closed 3 years ago

taca commented 3 years ago

I think that it is better to show original filename instead of temporary filename.

Toflar commented 3 years ago

Thanks for the contribution. This was done consiously because the original filename is arbitrary user input and can technically contain anything. I can even think of possible XSS attacks.

taca commented 3 years ago

Sure and I understand. Then I noticed that "File upload" form item has no validation for input (filename) and some check should be done. Yes, it is not the problem of contao-mp_form but Contao core...

Anyway thanks for your quick response.