The following files when uploaded are renamed accordingly

α.txt becomes txt.
(yes with . at the end ??)
αa.txt becomes a.txt

therefore the file is renamed in strange ways

but when first later is Latin Character
aα.txt does not get renamed

NOTE: above I am using α (the greek alpha character) as part of the filename for demonstration

----------------------
Was looking for a temporary solution (at least)
and found myself inside file.inc but I could not find out
where to set "allow_insecure_uploads" to 1 ?

Comments

giorgosk’s picture

giorgosk
Location Chios, Greece 🇬🇷
commented
Status: Active » Closed (fixed)

I revisited this problem today
and it does not seem to behave this way

maybe it was the browser I was using (FF3)

munzirtaha’s picture

munzirtaha commented
Version: 6.5 » 6.8
Status: Closed (fixed) » Active

I am facing this same problem. I cannot upload files with Arabic filenames. I tried to disable this check by adding

$conf = array(
  'allow_insecure_uploads' => 1,
);

to default/settings.php but the problem persist. I also tried

$conf['allow_insecure_uploads'] = 1;

to no avail.

I did the extreme of modifying file.inc and adding the previous lines like this

function file_munge_filename($filename, $extensions, $alerts = TRUE) {
  $original = $filename;
$conf['allow_insecure_uploads'] = 1;
  // Allow potentially insecure uploads for very savvy users and admin
  if (!variable_get('allow_insecure_uploads', 0)) {
...

But nothing works. So, first, what am I doing wrong here? Second, why this strange decision of making English alphabets secure whereas other languages alphabets are not? Why not just rename the dangerous characters instead?

munzirtaha’s picture

munzirtaha commented

More seriously, the file_munge_filename function seems to switch the $filename_parts and $extensions which could be a security risk. The problem is somehow related to Arabic being an RTL language, so drupal wrongly assumes the part to the right of the name is the extension which is wrong at least in my Firefox in linux.

heine’s picture

heine commented
Status: Active » Closed (duplicate)

Duplicate of #278425: Using basename() is not locale safe