Changeset 488

Timestamp:

Aug 26, 2014 11:50:45 AM (10 years ago)

Author:

anonymous

Message:

Improved cleanFileName method.

File:

• trunk/lib/Upload.inc.php (modified) (2 diffs)

trunk/lib/Upload.inc.php

@@ -474 +474 @@
 
     /**
-     * Removes unsafe characters from file name.
+     * Removes non-latin characters from file name, using htmlentities to convert known weirdos into regular squares.
      *
      * @access  public
@@ -482 +482 @@
     public function cleanFileName($file_name)
     {
-        $bad  = 'áéíóúà ÚìòùÀëïöÌÁÉÍÓÚÀÈÌÒÙÄËÏÖÜâêîÎûÂÊÎÔÛñçÇ';
-        $good = 'aeiouaeiouaeiouAEIOUAEIOUAEIOUaeiouAEIOUncC';
-        $file_name = trim($file_name);
-        $file_name = strtr($file_name, $bad, $good);
-        $file_name = preg_replace('/[^-\w.,~_=+()@]+/i', '_', $file_name);
-        $file_name = mb_substr($file_name, 0, 250);
-        return $file_name;
+        $file_name = preg_replace(array(
+            '/&([a-z]{1,2})(?:acute|cedil|circ|grave|lig|orn|ring|slash|th|tilde|uml|caron);/ui',
+            '/&(?:amp);/ui',
+            '/[&;]+/u',
+            '/[^a-zA-Z0-9()@._=+-]+/u',
+            '/^_+|_+$/u'
+        ), array(
+            '$1',
+            'and',
+            '',
+            '_',
+            ''
+        ), htmlentities($file_name, ENT_NOQUOTES | ENT_IGNORE, 'UTF-8'));
+        return mb_substr($file_name, 0, 250);
     }