Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'm looking for a way to sanitize the filename of user uploaded attachments.

I thought that wordpress already did it but I faced preblems after an user uploaded an attachment containing a '°' . That way the attachment is not downloadable.

I found out this wp function:

sanitize_file_name($filename)

is there a way to use it inside the

add_attachment

action?

thanks

share|improve this question
    
Can you tell the filename in full? Which encoding is your blog using? UTF-8? –  hakre Dec 22 '10 at 22:12
    
filename: ASSOSTAT-2°-TRIM.-09-10.pptx, and my database is set up with utf8 charset, is it better to remove the utf8 setting on wp-config.php? –  Dalen Dec 22 '10 at 22:20
    
It looks like a bug to me, those characters are invalid for filenames in URLs aren't they? I've logged it as a bug anyhow: core.trac.wordpress.org/ticket/15955 –  t31os Dec 22 '10 at 22:31
    
@t31os: is it the case of adding the '°' character to the $special_chars array you mentioned on the bug's ticket? –  Dalen Dec 22 '10 at 22:55
    
I'll wrap some info into answer, the comments area isn't suitable to cover it... –  t31os Dec 22 '10 at 23:07

2 Answers 2

Following on from question comments.

You can run a filter on sanitize_file_name_chars and add the degree symbol to the array of invalid chars, but it won't halt the upload it will simply strip the file extension.

However you can add another filter stop the upload, in a hacky kind of way by additionally hooking on the sanitize_file_name filter which occurs shortly after the one above, there you see if a file extension is present, if not you know there was a hit in the invalid chars array and you can die() inside the filter, which will cause the upload process to return a HTTP error(which is better then just silently dieing i guess).

add_filter( 'sanitize_file_name_chars', 'restrict_filename_chars' );

function restrict_filename_chars( $special_chars ) {
    $special_chars = array_merge( array( '°' ), $special_chars );
    return $special_chars;
}

add_filter( 'sanitize_file_name', 'die_on_no_ext' );

function die_on_no_ext( $filename ) {
    global $parts;
    if( $parts < 2 )
        die(-1);
    return $filename;
}

It's not an ideal solution mind you, and we'll see what happens with the ticket(i might just be missing something, i'm no expert on file validation).

NOTE: The filter only ensures the actual file name does not contain the degree symbol, not the "post name" (ie. the title of the attachment), you'll need another filter to deal with sanitizing the attachments title, as this is handled by different functions and filters.

share|improve this answer
    
this seems a good patch, i need will try it later on today. thanks –  Dalen Dec 23 '10 at 7:33
    
I don't think it's ideal, WP should be stopping invalid files from being processed, and it's exactly why i've raised a ticket, what good is an invalid chars array if hitting a match only strips off the file extension but let's the file through. –  t31os Dec 23 '10 at 10:46
    
i tested it but it is not working as epexpetced, at least the 1s filter. Nothing is changing on the filename, i tried also to add "°" directly to the $special_chars on wp-includes/formatting but nothing. The second filters seems to block too much, also valid filename attachments can't pass through it –  Dalen Dec 23 '10 at 23:40
    
I didn't test thoroughly, but i'm still sure there's a bug with that function and it's filters anyway, it should be doing more to sanitize strange character entities. I'll write a better workaround than the above when i get some more time to test. –  t31os Dec 27 '10 at 12:51
    
ok, i'm trying to do the same, thanks again and happy holidays –  Dalen Dec 27 '10 at 17:10

Look how I did it in my plugin Germanix URL. I hook into 'sanitize_file_name', convert what I need and strip anything else. This way, the file gets through, but the filename is valid.

I think this is the best possible user experience: No data is lost and no time, and no irritating error message pops up.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.