User tests: Successful: Unsuccessful:
It is currently possible to upload a file.min.css, file.min.js, file.asset.json
However it is not possible to rename or create a new file as we had a check to prevent having a . in the name
There really is no need for this restriction. It dates back 10 years to a security fix but it wasn't needed as the rest of the security fix is still valid.
NOTE: This does not add .min.css or .min.js or asset.json to the list of filetypes. They are still just css, js and json but now you can put a dot in the filename
Status | New | ⇒ | Pending |
Category | ⇒ | Administration com_templates Language & Strings |
I have tested this item
Status | Pending | ⇒ | Ready to Commit |
Labels |
Added:
Language Change
?
|
RTC
@brianteeman Does this PR solve the 2 issues #38455 and #30908 so they can be closed?
Just from code review: we have to be careful to not allow: "...hello...bla.min"
@bembelimen I did wonder about that but I assumed (maybe incorrectly) that as we didnt allow the slash it would not be a problem?
please remove the RTC on this.
@bembelimen was correct and we need to prevent a .. in the filename. I was only thinking of security but actually it blows away the php if its allowed. - will update this PR later
Status | Ready to Commit | ⇒ | Pending |
Back to pending due to reason stated in previous comment.
Please retest and confirm that you can now create, rename files with a dot in them AND that you cannot when there are two or more dots
Whats with a "invisible space" IIRC thats not catched by strpos. Or some kind of none breaking change as well as some unicode char thats confusing the filename/filesystem? didnt we have a filter class where we could throw this file name against too?
I have tested this item
Tested again. With one dot - the file was created, with two or more - an error.
I have tested this item
Status | Pending | ⇒ | Ready to Commit |
RTC
"." should not be allowed at the beginning of the name (as then the file is hidden) and also not at the end of the name (to avoid again the ".." with the extension.
should not be allowed at the beginning of the name
Its not - either before or after this pr. In both cases the leading dot is stripped
also not at the end of the name
yeah thats a bug in the regex will need to fix thaat after the holiday
please remove rtc for now
Status | Ready to Commit | ⇒ | Pending |
Back to pending.
Sorry I must have got distracted. I had the correct regex already written but for some reason I didnt include it.
You can test the regex here https://rextester.com/RULEP70144
I have tested this item
I have tested this item
Status | Pending | ⇒ | Ready to Commit |
RTC
RTC
Labels |
Added:
?
|
I would really like to merge it, but regex with this size are tricky and need more tests. I'm wondering where the underscore in the first regex went? But 4.3 has the time to test intensively, so I'm moving the PR.
There will be zero extra tests. Look at who has already tested it.
As @fancyFranci noticed, it does not allow underscore in the regexp anymore. A file name like joomla_78.min.css will fail.
Why are the regular expressions different in create/rename? Shouldn't they be identical?
Labels |
Added:
PR-4.3-dev
Removed: ? |
Sorry, don't want to be the party pooper again. So I tested it:
I also think I was wrong regaring the "." at the beginning, there is no test needed as the getCmd filter already removed the ".". So I think (?!.*\\..*\\..*)
is not needed at the beginning?
Status | Ready to Commit | ⇒ | Pending |
Back to pending
Please make up your minds.
Closed
Status | Pending | ⇒ | Closed |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2022-09-27 07:57:18 |
Closed_By | ⇒ | brianteeman | |
Labels |
Removed:
?
|
My intention was not to block it :( just giving it a proper testing as I think it's a nice feature.
The difference in create and edit comes from the fact that they both use a different regular expression, therefore you get different results. Nothing major :-)
@brianteeman this is a good PR, it addresses issues encountered by users.
Would you mind re-opening it? Thank you.
what he said
Thank you and super :-) @brianteeman @richard67
I have tested this item✅ successfully on 1e62228
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.