missed a check in MediaUploadTrait::checkFileMetadata()

getgrav · May 6, 2024 · 77adfcb · 77adfcb
1 parent ee8d783
commit 77adfcb
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,7 @@
    * Better handling of external protocols in `Utils::url()` such as `mailto:`, `tel:`, etc.
 1. [](#bugfix)
    * Fixes for multi-lang taxonomy when reinitializing the languages (e.g. LangSwitcher plugin) 
+   * Ensure the full filepath is checked for invalid filename in `Utils::checkFileMetadata()`
 
 # v1.7.45
 ## 03/18/2024

diff --git a/system/src/Grav/Common/Media/Traits/MediaUploadTrait.php b/system/src/Grav/Common/Media/Traits/MediaUploadTrait.php
@@ -156,7 +156,7 @@ public function checkFileMetadata(array $metadata, string $filename = null, arra
         $filepath = $folder . $filename;
 
         // Check if the filename is allowed.
-        if (!Utils::checkFilename($filename)) {
+        if (!Utils::checkFilename($filepath)) {
             throw new RuntimeException(
                 sprintf($this->translate('PLUGIN_ADMIN.FILEUPLOAD_UNABLE_TO_UPLOAD'), $filepath, $this->translate('PLUGIN_ADMIN.BAD_FILENAME'))
             );