mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 22:26:08 +00:00
Code Issues 32 Releases Wiki Activity

Fixed #26325 -- Made MultiPartParser ignore filenames that normalize to an empty string.

Browse Source
This commit is contained in:
John-Mark Bell
2016-03-07 12:06:46 +00:00
committed by Tim Graham
parent 75614f6d4c
commit 4b129ac81f
4 changed files with 44 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
django/http/multipartparser.py
View File

@@ -181,10 +181,11 @@ class MultiPartParser(object):
elif item_type == FILE:
# This is a file, use the handler...
file_name = disposition.get('filename')
if file_name:
file_name = force_text(file_name, encoding, errors='replace')
file_name = self.IE_sanitize(unescape_entities(file_name))
if not file_name:
continue
file_name = force_text(file_name, encoding, errors='replace')
file_name = self.IE_sanitize(unescape_entities(file_name))
content_type, content_type_extra = meta_data.get('content-type', ('', {}))
content_type = content_type.strip()