diff --git a/manager/includes/document.parser.class.inc.php b/manager/includes/document.parser.class.inc.php index 58fbed46c..45145a0e0 100644 --- a/manager/includes/document.parser.class.inc.php +++ b/manager/includes/document.parser.class.inc.php @@ -5852,7 +5852,7 @@ public function move_uploaded_file($tmp_path, $target_path) * @param string $filepath フルパス * @return string サニタイズされたフルパス */ - private function sanitizeUploadedFilename($filepath) + public function sanitizeUploadedFilename($filepath) { $dir = dirname($filepath); $filename = basename($filepath); @@ -5867,17 +5867,19 @@ private function sanitizeUploadedFilename($filepath) $ext = ''; } - // ASCII文字以外を含む場合のみ処理 - if (preg_match('/[^\x20-\x7E]/', $name)) { - // タイムスタンプベースの安全なファイル名を生成 - $timestamp = date('Y-md'); - $random = substr(md5(uniqid(mt_rand(), true)), 0, 8); - $name = sprintf('%s-%s', $timestamp, $random); + if ($this->config('clean_uploaded_filename') == 1) { + $name = $this->stripAlias($name, ['file_manager']); } // 安全でない文字を除去 $name = preg_replace('/[^a-zA-Z0-9._-]/', '_', $name); + if ($name === '') { + $timestamp = date('Ymd'); + $random = substr(md5(uniqid(mt_rand(), true)), 0, 8); + $name = sprintf('%s-%s', $timestamp, $random); + } + return $dir . '/' . $name . $ext; } diff --git a/manager/media/browser/mcpuk/connectors/Commands/FileUpload.php b/manager/media/browser/mcpuk/connectors/Commands/FileUpload.php index 5813633be..d12d69a7a 100644 --- a/manager/media/browser/mcpuk/connectors/Commands/FileUpload.php +++ b/manager/media/browser/mcpuk/connectors/Commands/FileUpload.php @@ -72,14 +72,6 @@ function run() } } - if ($modx->config['clean_uploaded_filename'] == 1 && isset($ext)) { - $originalFilename = $filename; - $filename = $modx->stripAlias($filename, ['file_manager']); - if ($filename !== $originalFilename) { - $disp = "201,'ファイル名に使えない文字が含まれているため変更しました。'"; - } - } - if (!array_key_exists('NewFile', $_FILES)) $disp = "202,'Unable to find uploaded file.'"; //No file uploaded with field name NewFile elseif ($_FILES['NewFile']['error'] || ($typeconfig['MaxSize']) < $_FILES['NewFile']['size']) { $disp = "202,'ファイル容量オーバーです。'";//Too big @@ -130,6 +122,13 @@ function run() $tmp_name = $_FILES['NewFile']['tmp_name']; $filename = "{$basename}.{$ext}"; $target = "{$this->real_cwd}/{$filename}"; + $originalFilename = $filename; + $target = $modx->sanitizeUploadedFilename($target); + $filename = basename($target); + $basename = substr($filename, 0, strrpos($filename, '.')); + if ($filename !== $originalFilename) { + $disp = "201,'ファイル名に使えない文字が含まれているため変更しました。'"; + } if (!is_file($target)) { //Upload file $rs = $this->file_upload($tmp_name, $target);