mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-05 00:29:48 +03:00
Can't upload macOS screenshots with default filename due to no_double_extension check #1910
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @abulgatz on GitHub (Oct 20, 2020).
Describe the bug
Mac screenshots taken with control + command + shift + 3 (or 4) are automatically saved to the desktop as a png with filename:
Screen Shot YYYY-MM-DD at HH.MM.SS AM.png.The extra periods in the filename fail the
no_double_extensioncheck the Bookstack runs on all uploaded images, so macOS screenshots can't be uploaded to Bookstack without renaming them.Steps To Reproduce
Steps to reproduce the behavior:
Expected behavior
Bookstack shouldn't care about extra dots in a filename.
Screenshots
Additional context
I don't think there's any reason that Bookstack should care about periods in a filename. If Bookstack needs an extension, it's easy enough to grab any text after the last dot. Is there something that would break if the
no_double_extensionwas just removed? I can't think of any other web or desktop apps that reject extra periods in a filename.@ssddanbrown commented on GitHub (Dec 11, 2020):
Thanks for reporting this @abulgatz.
Since this is already open under #2217 I'm going to close this off as a duplicate.
The
no_double_extensioncheck is done on purpose to avoid a range of potential path-based attacks in addition to avoiding some potential attacks based off of how Apache can interpret some file name/extension formats.It was a rather hastily added patch though when needing to do so in the name of security. As said in #2217, We could probably do better by just replacing/removing any additional periods within the name.