fix: disallow # char in file uploads (#3770)

4 years ago · 9081232e7c
parent 0788d615bc
commit 9081232e7c
1 changed files with 1 additions and 1 deletions
--- a/server/controllers/upload.js
+++ b/server/controllers/upload.js
@ -76,7 +76,7 @@ router.post('/u', (req, res, next) => {
  }

  // Sanitize filename
-  fileMeta.originalname = sanitize(fileMeta.originalname.toLowerCase().replace(/[\s,;]+/g, '_'))
+  fileMeta.originalname = sanitize(fileMeta.originalname.toLowerCase().replace(/[\s,;#]+/g, '_'))

  // Check if user can upload at path
  const assetPath = (folderId) ? hierarchy.map(h => h.slug).join('/') + `/${fileMeta.originalname}` : fileMeta.originalname