fix: disallow # char in file uploads (#3770)

requarks · May 20, 2021 · 9081232 · 9081232
1 parent 0788d61
commit 9081232
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/server/controllers/upload.js b/server/controllers/upload.js
@@ -76,7 +76,7 @@ router.post('/u', (req, res, next) => {
   }
 
   // Sanitize filename
-  fileMeta.originalname = sanitize(fileMeta.originalname.toLowerCase().replace(/[\s,;]+/g, '_'))
+  fileMeta.originalname = sanitize(fileMeta.originalname.toLowerCase().replace(/[\s,;#]+/g, '_'))
 
   // Check if user can upload at path
   const assetPath = (folderId) ? hierarchy.map(h => h.slug).join('/') + `/${fileMeta.originalname}` : fileMeta.originalname