[media] Special characters issue

modules/media/ajax/FileUpload.php

@@ -116,7 +116,7 @@ function uploadFile()
     // If required fields are not set, show an error
     if (empty($_FILES)) {
         showMediaError(
-            "File could not be uploaded successfully. 
+            "File could not be uploaded successfully.
             Please contact the administrator.",
             400
         );
@@ -129,7 +129,10 @@ function uploadFile()
 
     checkDateTaken($dateTaken);
 
-    $fileName  = preg_replace('/\s/', '_', $_FILES["file"]["name"]);
+    $fileName = preg_replace('/\s/', '_', $_FILES["file"]["name"]);
+    // urldecode() necessary to decode double quotes encoded automatically
+    // by chrome browsers to avoid XSS attacks
+    $fileName  = urldecode($fileName);
     $fileType  = $_FILES["file"]["type"];
     $extension = pathinfo($fileName)['extension'];
 
@@ -178,7 +181,7 @@ function uploadFile()
     if (move_uploaded_file($_FILES["file"]["tmp_name"], $mediaPath . $fileName)) {
         try {
             // Insert or override db record if file_name already exists
-            $db->insertOnDuplicateUpdate('media', $query);
+            $db->unsafeInsertOnDuplicateUpdate('media', $query);
             $uploadNotifier->notify(array("file" => $fileName));
         } catch (DatabaseException $e) {
             showMediaError("Could not upload the file. Please try again!", 500);

tools/single_use/Cleanup_Special_Chars_Media.php

@@ -0,0 +1,54 @@
+<?php
+/**
+ * This script is written to clean up the files with special characters from the media data table as well as clean up the
+ * quotes appearing as %22 in the file names in the file system
+ *
+ * To use the script: php Cleanup_Special_Chars_Media.php
+ *
+ *
+ * PHP Version 7
+ *
+ * @category Main
+ * @package Loris
+ * @author Pierre PAC SOO <pierre.pacsoo@mcin.ca>
+ * @license Loris license
+ * @link https://www.github.com/aces/Loris-Trunk/
+ */
+
+require_once __DIR__."/../generic_includes.php";
+$config = NDB_Config::singleton();
+
+$media_path = $config->getSetting('mediaPath');
+
+$data = $DB->pselect(
+    "SELECT id, file_name
+        FROM media",
+    []
+);
+
+foreach($data as $key => $file) {
+
+    // fileNameURLencoded is needed for the step line 48 as the file name got rid of '"' and replaced it with %22
+    // urldecode will get rid of %22 and replace it correctly for it to be inserted into the table
+    $fileNameURLencoded = htmlspecialchars_decode($file['file_name']);
+    $fileName = urldecode($fileNameURLencoded);
+
+    // update only if file name has been updated
+    if($fileName !== $file['file_name']) {
+
+        // change name in sql table media
+        $DB->unsafeupdate(
+            "media",
+            [
+                "file_name" => $fileName
+            ],
+            [
+                "id" => $file['id']
+            ]
+        );
+
+        // update name in file system
+        rename($media_path.$fileNameURLencoded, $media_path.$fileName);
+        print("Old file name: " . $file['file_name'] . ". New file name: " . $fileName . "\n\n");
+    }
+}