diff options
| author | Erik Johnston <erik@matrix.org> | 2015-06-30 10:31:59 +0100 |
|---|---|---|
| committer | Erik Johnston <erik@matrix.org> | 2015-06-30 10:31:59 +0100 |
| commit | 9beaedd1642673d36428dd796dda62f18a937c2a (patch) | |
| tree | a0cf3fbef32d851abc0ae922a9a62646c292eae3 /synapse/rest/media/v1/upload_resource.py | |
| parent | Add Content-Disposition headers to media repo v1 downloads (diff) | |
| download | synapse-9beaedd1642673d36428dd796dda62f18a937c2a.tar.xz | |
Enforce ascii filenames for uploads
Diffstat (limited to 'synapse/rest/media/v1/upload_resource.py')
| -rw-r--r-- | synapse/rest/media/v1/upload_resource.py | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/synapse/rest/media/v1/upload_resource.py b/synapse/rest/media/v1/upload_resource.py index 92e855a448..cdd1d44e07 100644 --- a/synapse/rest/media/v1/upload_resource.py +++ b/synapse/rest/media/v1/upload_resource.py @@ -15,7 +15,7 @@ from synapse.http.server import respond_with_json, request_handler -from synapse.util.stringutils import random_string +from synapse.util.stringutils import random_string, is_ascii from synapse.api.errors import SynapseError from twisted.web.server import NOT_DONE_YET @@ -87,6 +87,8 @@ class UploadResource(BaseMediaResource): upload_name = request.args.get("filename", None) if upload_name: upload_name = upload_name[0] + if upload_name and not is_ascii(upload_name): + raise SynapseError(400, "filename must be ascii") headers = request.requestHeaders |