[ http://issues.apache.org/jira/browse/FILEUPLOAD-122?page=all ]
Jochen Wiedmann resolved FILEUPLOAD-122.
----------------------------------------
Resolution: Invalid
I was initially thinking that the request made some sense, but after reading
the various comments in this bug as well as FILEUPLOAD-17 (or FILEUPLOAD-68 for
that matter), I do wholeheartly agree with the current behaviour to leave the
filename as it is sent by the browser. If the user actually wants to remove
preceding path components then he can do so quite easily. The converse wouldn't
be true, if we'd attempt to "sanitize" the name.
As this topic has been discussed now in at least three cases and all developers
agree on it, I am closing the bug.
> Filename may contain a full path
> --------------------------------
>
> Key: FILEUPLOAD-122
> URL: http://issues.apache.org/jira/browse/FILEUPLOAD-122
> Project: Commons FileUpload
> Issue Type: Bug
> Affects Versions: 1.1.1
> Reporter: Sebastian Beigel
> Priority: Blocker
>
> The filename extracted from the content disposition may contain a full path
> (i.e. as submitted by the Internet Explorer for example).
> It's is important to check for this and strip the path information
> accordingly as the upload fails if you use FileItem#getName() to build your
> destination path.
> I patched the abstract class FileUploadBase#getFileName(...) with a few lines
> of code inspired by COS' MultiPartParser :)
> Starting on line 447 (after fileName = fileName.trim(); )
> // The filename may contain a full path. Cut to just
> the filename.
> int slash = Math.max(fileName.lastIndexOf('/'),
> fileName.lastIndexOf('\\')); // check for Unix AND Win separator
> if (slash > -1) {
> fileName = fileName.substring(slash + 1); // past
> last slash
> }
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
