#32718: [3.2.1] Issue with assigning file to FileField
-------------------------------------+-------------------------------------
Reporter: Jakub Kleň | Owner: nobody
Type: Bug | Status: new
Component: Database layer | Version: 2.2
(models, ORM) |
Severity: Release blocker | Resolution:
Keywords: 3.2.1 file model | Triage Stage: Accepted
filefield fieldfile |
Has patch: 1 | Needs documentation: 1
Needs tests: 1 | Patch needs improvement: 1
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by carderm):
Replying to [comment:8 Florian Apolloner]:
Replying to [comment:7 Mariusz Felisiak]:
Thanks Mariusz Felisiak, you're correct - these changes will break
Django's file system and cause files to possibly be overwritten. **It must
not go ahead.**
**The core issue** was the addition of an unneccessary check added here:
[https://github.com/django/django/blob/main/django/core/files/utils.py#L7]
{{{
def validate_file_name(name):
if name != os.path.basename(name):
raise SuspiciousFileOperation("File name '%s' includes path
elements" % name)
}}}
It currently appends (joins) the file name to upload_to.
--
Ticket URL: <https://code.djangoproject.com/ticket/32718#comment:10>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/064.7b0abec3f070980110d601fb461f1cc6%40djangoproject.com.
