[ php-blog-Bugs-1850031 ] Media Library fails when creating directory ending in "."

Bugs item #1850031, was opened at 2007-12-13 14:14
Message generated for change (Comment added) made by evoncken
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1850031&group_id=75065

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Administrative functions
Group: None
Status: Closed
Resolution: Wont Fix
Priority: 1
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Garvin Hicking (garvinhicking)
Summary: Media Library fails when creating directory ending in "."

Initial Comment:
Version: Serendipity 1.2
OS: CentOS 5

Steps to reproduce problem:
- Go to admin page
- Click "Manage directories"
- Create new directory "Test."
- Try to upload picture to new directory, this fails

Apparently the URL is sanitized, because the upload attempts to use "Test/" instead of "Test./"

Thanks to my mom for finding the bug ;-)

Greetings,
  Ed.

----------------------------------------------------------------------

Comment By: Ed Voncken (evoncken)
Date: 2007-12-13 15:24

Message:
Logged In: YES 
user_id=65335
Originator: NO

I don't think this issue should have been closed - it is an extremely
annoying bug, and a "mere mortal" cannot understand or fix the problem.

It is an input validation problem - the system should not accept input
that it cannot handle.

A simple check on "m/\.$/" would suffice to avoid the issue altogether. Is
that an option?

Greetings,
  Ed.

----------------------------------------------------------------------

Comment By: Garvin Hicking (garvinhicking)
Date: 2007-12-13 15:02

Message:
Logged In: YES 
user_id=473563
Originator: NO

Hi!

Thanks for reporting, however as you already mentioned: This is more a
sanitizing security issues than a bug. We can't really fix this, because
then we might be subject to directory traversal attacks. It shold work when
you use "Test.X", i.e. a dot can never appear next to a directory slash.

Regards,
Garvin

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2007-12-13 14:15

Message:
Logged In: NO 

Sorry, forgot to log on - I'm evoncken at sourceforge.net

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1850031&group_id=75065

-------------------------------------------------------------------------
SF.Net email is sponsored by:
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services
for just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace