From 1e6e97e750882e386dce095737dc78c9b53ccc86 Mon Sep 17 00:00:00 2001
From: Bowrna <mailbowrna@gmail.com>
Date: Mon, 5 Aug 2024 20:08:33 +0530
Subject: [PATCH] Add validation for filename with non-ASCII chars in media
 upload (#1973)

---
 cmd/media.go                   |  4 ++++
 cmd/utils.go                   | 10 ++++++++++
 docs/docs/content/apis/apis.md | 25 +++++++++++++------------
 i18n/en.json                   |  1 +
 4 files changed, 28 insertions(+), 12 deletions(-)

diff --git a/cmd/media.go b/cmd/media.go
index b7b3b732..be4c9a63 100644
--- a/cmd/media.go
+++ b/cmd/media.go
@@ -48,6 +48,10 @@ func handleUploadMedia(c echo.Context) error {
 		ext         = strings.TrimPrefix(strings.ToLower(filepath.Ext(file.Filename)), ".")
 		contentType = file.Header.Get("Content-Type")
 	)
+	if !isASCII(file.Filename) {
+		return echo.NewHTTPError(http.StatusUnprocessableEntity,
+			app.i18n.Ts("media.invalidFileName", "name", file.Filename))
+	}
 
 	// Validate file extension.
 	if !inArray("*", app.constants.MediaUpload.Extensions) {
diff --git a/cmd/utils.go b/cmd/utils.go
index 763ae937..84c9cb29 100644
--- a/cmd/utils.go
+++ b/cmd/utils.go
@@ -8,6 +8,7 @@ import (
 	"regexp"
 	"strconv"
 	"strings"
+	"unicode"
 )
 
 var (
@@ -113,3 +114,12 @@ func titleCase(input string) string {
 
 	return strings.Join(parts, " ")
 }
+
+func isASCII(s string) bool {
+	for _, c := range s {
+		if c > unicode.MaxASCII {
+			return false
+		}
+	}
+	return true
+}
diff --git a/docs/docs/content/apis/apis.md b/docs/docs/content/apis/apis.md
index b11642f3..4e6af46a 100644
--- a/docs/docs/content/apis/apis.md
+++ b/docs/docs/content/apis/apis.md
@@ -44,15 +44,16 @@ All timestamp fields are in the format `2019-01-01T09:00:00.000000+05:30`. The s
 
 ### Common HTTP error codes
 
-| Code  |                                                                          |
-| ----- | ------------------------------------------------------------------------ |
-|  400  | Missing or bad request parameters or values                              |
-|  403  | Session expired or invalidate. Must relogin                              |
-|  404  | Request resource was not found                                           |
-|  405  | Request method (GET, POST etc.) is not allowed on the requested endpoint |
-|  410  | The requested resource is gone permanently                               |
-|  429  | Too many requests to the API (rate limiting)                             |
-|  500  | Something unexpected went wrong                                          |
-|  502  | The backend OMS is down and the API is unable to communicate with it     |
-|  503  | Service unavailable; the API is down                                     |
-|  504  | Gateway timeout; the API is unreachable                                  |
+| Code  |                                                                             |
+| ----- | ----------------------------------------------------------------------------|
+|  400  | Missing or bad request parameters or values                                 |
+|  403  | Session expired or invalidate. Must relogin                                 |
+|  404  | Request resource was not found                                              |
+|  405  | Request method (GET, POST etc.) is not allowed on the requested endpoint    |
+|  410  | The requested resource is gone permanently                                  |
+|  422  | Unprocessable entity. Unable to process request as it contains invalid data |
+|  429  | Too many requests to the API (rate limiting)                                |
+|  500  | Something unexpected went wrong                                             |
+|  502  | The backend OMS is down and the API is unable to communicate with it        |
+|  503  | Service unavailable; the API is down                                        |
+|  504  | Gateway timeout; the API is unreachable                                     |
diff --git a/i18n/en.json b/i18n/en.json
index 8c5ae6d9..91e4bcb8 100644
--- a/i18n/en.json
+++ b/i18n/en.json
@@ -288,6 +288,7 @@
     "media.errorSavingThumbnail": "Error saving thumbnail: {error}",
     "media.errorUploading": "Error uploading file: {error}",
     "media.invalidFile": "Invalid file: {error}",
+    "media.invalidFileName": "Invalid filename {name}. Use only ASCII characters",
     "media.title": "Media",
     "media.unsupportedFileType": "Unsupported file type ({type})",
     "media.upload": "Upload",