5 Commits

Author	SHA1	Message	Date
Mariusz Felisiak	224b8e5a5a	[3.2.x] Fixed #32718 -- Relaxed file name validation in FileField. ... - Validate filename returned by FileField.upload_to() not a filename passed to the FileField.generate_filename() (upload_to() may completely ignored passed filename). - Allow relative paths (without dot segments) in the generated filename. Thanks to Jakub Kleň for the report and review. Thanks to all folks for checking this patch on existing projects. Thanks Florian Apolloner and Markus Holtermann for the discussion and implementation idea. Regression in 0b79eb36915d178aef5c6a7bbce71b1e76d376d3. Backport of b55699968fc9ee985384c64e37f6cc74a0a23683 from main	2021-05-13 08:55:00 +02:00
Carlton Gibson	a937d7f214	[3.2.x] Refs CVE-2021-31542 -- Skipped mock AWS storage test on Windows. ... The validate_file_name() sanitation introduced in 0b79eb36915d178aef5c6a7bbce71b1e76d376d3 correctly rejects the example file name as containing path elements on Windows. This breaks the test introduced in 914c72be2abb1c6dd860cb9279beaa66409ae1b2 to allow path components for storages that may allow them. Test is skipped pending a discussed storage refactoring to support this use-case. Backport of a708f39ce67af174df90c5b5e50ad1976cec7cb8 from main	2021-05-06 07:42:21 +02:00
Florian Apolloner	c98f446c18	[3.2.x] Fixed CVE-2021-31542 -- Tightened path & file name sanitation in file uploads.	2021-05-04 08:43:52 +02:00
Tim Graham	0dfc5479a8	Refs #26058 -- Removed deprecated FileField.get_directory_name()/get_filename().	2017-01-17 20:52:04 -05:00
Cristiano	914c72be2a	Fixed #26058 -- Delegated os.path bits of FileField's filename generation to the Storage.	2016-04-30 17:22:40 -04:00