⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

The parameter 'forbidden_chars,' introduced in Nextcloud 28 for setting prohibited characters, applies restrictions only when creating or renaming files and folders through the WebUI. This restriction does not extend to file uploads.

Could you please update the functionality to ensure that this parameter is also applied during file uploads?

The restriction does not apply to file uploads through the WebUI drag and drop or the "Upload files" using the +New button.

Steps to reproduce

1. • New
2. Upload files
3. Test#.txt

Expected behavior

Thest "Test#.txt" should also be declined because of the restricted character like it is already done for folders

Installation method

None

Nextcloud Server version

28

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.2

Web server

Nginx

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

No response

List of activated Apps

No response

Nextcloud Signing status

No response

Nextcloud Logs

No response

Additional info

No response