- Issue created by @vetchneons
- 🇬🇧United Kingdom catch
@vetchneons is this a regression due to 📌 Always rename dot files like Drupal 7 Needs work (which was just committed yesterday) or does it pre-exist that issue?
- 🇺🇸United States vetchneons
@catch, thanks for the quick reply -- this predates that issue.
- 🇳🇿New Zealand quietone
In Drupal core changes are made on on 11.x (our main development branch) first, and are then back ported as needed according to the Core change policies → . Also mentioned on the version → section of the list of issue fields documentation.
- First commit to issue fork.
- Merge request !12503Update file SecurityFileUploadEventSubscriber.php → (Open) created by immaculatexavier
- 🇮🇳India immaculatexavier
Created MR in accordance to the Proposed resolution against 11.x.
- 🇺🇸United States smustgrave
@ immaculatexavier thanks but did you read the comments? Just blindly taking the proposed solution isn’t always the way.
@ vetchneons did the issue catch post resolve this issue?
NW because this has no test coverage
- 🇺🇸United States vetchneons
@smustgrave, thanks for asking. I am not seeing the issue resolved with the changes applied from the issue @catch posted.
I tested both with allow_insecure_uploads set to "true" and "false".
In both instances, the behavior I described above is still happening: "test.image.jpg" is getting renamed and "test.images.jpg" is not.
I see this code goes back to Drupal 4 for SA-2006-006. I don't know enough about the issue to know if what this regex is trying to capture is mitigated by something else, or if it's still good to have this as a check.
It was confusing to try to track down when the filename had two '.' in it, and the string after the first '.' didn't resemble a file extension.