starred/panel-pelican-dev
1
0
Fork 0
mirror of https://github.com/pelican-dev/panel.git synced 2026-05-04 18:00:48 +03:00
Code Issues 41 Packages Projects Releases 10 Wiki Activity

File browser breaking due to special character in file name #296

New Issue
Closed
opened 2026-02-05 17:23:49 +03:00 by OVERLORD · 4 comments
OVERLORD commented 2026-02-05 17:23:49 +03:00
Owner
Copy Link

Originally created by @nzxl101 on GitHub (Apr 3, 2025).

Originally assigned to: @rmartinoscar on GitHub.

Current Behavior

When uploading a file through URL that contains special characters e.g. a quotation mark, the whole file browser will stop working until the file has been deleted through SFTP.

Expected Behavior

Be able to upload files with special characters by properly escaping/or removing them.

Steps to Reproduce

  1. Go to Files
  2. Upload
  3. Upload from URL/or local
  4. URL input: https://mediafilez.forgecdn.net/files/5317/51/Sneak%27s%20RPG%20Pack%20SERVER.zip

Panel Version

1.0.0-beta18

Wings Version

1.0.0-beta10

Games and/or Eggs Affected

No response

Docker Image

No response

Error Logs

Is there an existing issue for this?

  • I have searched the existing issues before opening this issue.
  • I have provided all relevant details, including the specific game and Docker images I am using if this issue is related to running a server.
  • I have checked in the Discord server and believe this is a bug with the software, and not a configuration issue with my specific system.
Originally created by @nzxl101 on GitHub (Apr 3, 2025). Originally assigned to: @rmartinoscar on GitHub. ### Current Behavior When uploading a file through URL that contains special characters e.g. a quotation mark, the whole file browser will stop working until the file has been deleted through SFTP. ### Expected Behavior Be able to upload files with special characters by properly escaping/or removing them. ### Steps to Reproduce 1. Go to Files 2. Upload 3. Upload from URL/or local 4. URL input: https://mediafilez.forgecdn.net/files/5317/51/Sneak%27s%20RPG%20Pack%20SERVER.zip ### Panel Version 1.0.0-beta18 ### Wings Version 1.0.0-beta10 ### Games and/or Eggs Affected _No response_ ### Docker Image _No response_ ### Error Logs ```bash ``` ### Is there an existing issue for this? - [x] I have searched the existing issues before opening this issue. - [x] I have provided all relevant details, including the specific game and Docker images I am using if this issue is related to running a server. - [x] I have checked in the Discord server and believe this is a bug with the software, and not a configuration issue with my specific system.
OVERLORD added the 🟡 medium label 2026-02-05 17:23:49 +03:00
OVERLORD commented 2026-02-05 17:23:52 +03:00
Author
Owner
Copy Link

@rmartinoscar commented on GitHub (Apr 3, 2025):

Hey please provide more logs, i just tried Upload > From URL and i get

Image

DEBUG: [Apr  3 15:30:53.577] writing remote file to disk path=/Sneak's RPG Pack SERVER.zip server=ed4f088e-18d6-4b36-a691-0f145399d1e5
DEBUG: [Apr  3 15:30:57.126] GET /api/system/utilization client_ip=127.0.0.1 latency=1.232498ms request_id=18a37ae0-152b-44a2-ba12-bf4d0c458a05 status=200
INFO: [Apr  3 15:30:59.822] completed pull of remote file download_id=c4e4dfbb-f53a-4d59-8b04-360a74baecc2 server=ed4f088e-18d6-4b36-a691-0f145399d1e5
DEBUG: [Apr  3 15:31:03.296] GET /api/system/utilization client_ip=127.0.0.1 latency=1.192242ms request_id=e65eded6-473b-4165-a21b-c70529b61a70 status=200
DEBUG: [Apr  3 15:31:03.700] GET /api/servers/ed4f088e-18d6-4b36-a691-0f145399d1e5/files/list-directory?directory=%2F client_ip=127.0.0.1 latency=264.776µs request_id=d75c4ae9-9f09-40db-bc7e-91f3ba916714 status=200
@rmartinoscar commented on GitHub (Apr 3, 2025): Hey please provide more logs, i just tried Upload > From URL and i get ![Image](https://github.com/user-attachments/assets/fca03e85-ef73-4898-872e-4ffe42c48e47) ``` DEBUG: [Apr 3 15:30:53.577] writing remote file to disk path=/Sneak's RPG Pack SERVER.zip server=ed4f088e-18d6-4b36-a691-0f145399d1e5 DEBUG: [Apr 3 15:30:57.126] GET /api/system/utilization client_ip=127.0.0.1 latency=1.232498ms request_id=18a37ae0-152b-44a2-ba12-bf4d0c458a05 status=200 INFO: [Apr 3 15:30:59.822] completed pull of remote file download_id=c4e4dfbb-f53a-4d59-8b04-360a74baecc2 server=ed4f088e-18d6-4b36-a691-0f145399d1e5 DEBUG: [Apr 3 15:31:03.296] GET /api/system/utilization client_ip=127.0.0.1 latency=1.192242ms request_id=e65eded6-473b-4165-a21b-c70529b61a70 status=200 DEBUG: [Apr 3 15:31:03.700] GET /api/servers/ed4f088e-18d6-4b36-a691-0f145399d1e5/files/list-directory?directory=%2F client_ip=127.0.0.1 latency=264.776µs request_id=d75c4ae9-9f09-40db-bc7e-91f3ba916714 status=200 ```
OVERLORD commented 2026-02-05 17:23:53 +03:00
Author
Owner
Copy Link

@nzxl101 commented on GitHub (Apr 3, 2025):

Hi,
It's not an issue with the upload process itself but rather a client side bug that breaks the JavaScript and renders the file browser unusable. You can't edit/delete/replace any files after such a file has been uploaded

Image

@nzxl101 commented on GitHub (Apr 3, 2025): Hi, It's not an issue with the upload process itself but rather a client side bug that breaks the JavaScript and renders the file browser unusable. You can't edit/delete/replace any files after such a file has been uploaded ![Image](https://github.com/user-attachments/assets/9dc47b6b-4677-4b43-a798-d721b9040c17)
OVERLORD commented 2026-02-05 17:23:54 +03:00
Author
Owner
Copy Link

@rmartinoscar commented on GitHub (Apr 3, 2025):

Oh i see you can't do any action now, I'll investigate.

@rmartinoscar commented on GitHub (Apr 3, 2025): Oh i see you can't do any action now, I'll investigate.
OVERLORD commented 2026-02-05 17:23:55 +03:00
Author
Owner
Copy Link

@weeaudi commented on GitHub (Apr 26, 2025):

This is also potentially a security vulnerability. Because of this issue, I am not 100% sure if it was possible to embed JS into the file name running code on anyone who visited the files page

@weeaudi commented on GitHub (Apr 26, 2025): This is also potentially a security vulnerability. Because of this issue, I am not 100% sure if it was possible to embed JS into the file name running code on anyone who visited the files page
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
not confirmed
pull-request
Mirrored from GitHub Pull Request
 👑 sponsor
💰 fund
🔴 hard
🟡 medium
🟡 medium
🟡 medium
🟢 easy
🟢 easy
🟢 easy
No Label 🟡 medium
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/panel-pelican-dev#296
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?