[Bug]: [stable28] "forbidden_chars" config not effective

[julien-nc]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

It is still possible to rename files with forbidden characters in the Files app.

I could track it down to an initial state value being provided in https://github.com/nextcloud/server/blob/stable28/apps/files/lib/Controller/ViewController.php#L277
and the name validation check being done in https://github.com/nextcloud/server/blob/stable28/apps/files/src/utils/filenameValidity.ts#L28-L29 with validateFilename from @nextcloud/files. Maybe the initial state value is not handled correctly...

Steps to reproduce

1. Set 'forbidden_chars' => ['+', '%', '#', '?', '<', '>', ':', '*', '|', '"'], in config.php
2. Rename a file with a name that contains one of the forbidden characters

Expected behavior

In NC 29.0.9, it is prevented and a hint is displayed:

Nextcloud Server version

28

Operating system

None

PHP engine version

None

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response