template min.css and min.js etc

[brianteeman]

It is currently possible to upload a file.min.css, file.min.js, file.asset.json

However it is not possible to rename or create a new file as we had a check to prevent having a . in the name

There really is no need for this restriction. It dates back 10 years to a security fix but it wasn't needed as the rest of the security fix is still valid.

NOTE: This does not add .min.css or .min.js or asset.json to the list of filetypes. They are still just css, js and json but now you can put a dot in the filename

[N6REJ]

I have tested this item :white_check_mark: successfully on 1e62228bd7816a8a38904d7f664b9b8fedb4e4fc

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.}

[Kostelano]

I have tested this item :white_check_mark: successfully on 1e62228bd7816a8a38904d7f664b9b8fedb4e4fc

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.}

[richard67]

RTC

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.}

[richard67]

@brianteeman Does this PR solve the 2 issues #38455 and #30908 so they can be closed?

[bembelimen]

Just from code review: we have to be careful to not allow: "...hello...bla.min"

[brianteeman]

@bembelimen I did wonder about that but I assumed (maybe incorrectly) that as we didnt allow the slash it would not be a problem?

[brianteeman]

please remove the RTC on this.

@bembelimen was correct and we need to prevent a .. in the filename. I was only thinking of security but actually it blows away the php if its allowed. - will update this PR later

[richard67]

Back to pending due to reason stated in previous comment.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.}

[brianteeman]

Please retest and confirm that you can now create, rename files with a dot in them AND that you cannot when there are two or more dots

[zero-24]

Whats with a "invisible space" IIRC thats not catched by strpos. Or some kind of none breaking change as well as some unicode char thats confusing the filename/filesystem? didnt we have a filter class where we could throw this file name against too?

[brianteeman]

@zero-24 The file is already going through a filter before this iirc. If not then its beyond the scope of this PR as it would be possible before this PR as well. please test those yourself.

[Kostelano]

I have tested this item :white_check_mark: successfully on fa2068eaa65eb69fba1f7cc2606934429793d0a4

Tested again. With one dot - the file was created, with two or more - an error.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.}

[jwaisner]

I have tested this item :white_check_mark: successfully on fa2068eaa65eb69fba1f7cc2606934429793d0a4

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.}

[jwaisner]

RTC

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.}

[bembelimen]

"." should not be allowed at the beginning of the name (as then the file is hidden) and also not at the end of the name (to avoid again the ".." with the extension.

[brianteeman]

should not be allowed at the beginning of the name Its not - either before or after this pr. In both cases the leading dot is stripped

also not at the end of the name yeah thats a bug in the regex will need to fix thaat after the holiday

[brianteeman]

please remove rtc for now

[richard67]

Back to pending.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.}

[brianteeman]

Sorry I must have got distracted. I had the correct regex already written but for some reason I didnt include it.

You can test the regex here https://rextester.com/RULEP70144

[Kostelano]

I have tested this item :white_check_mark: successfully on e291abbb929f91beaaa51844d790b23259134efa

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.}

[viocassel]

I have tested this item :white_check_mark: successfully on e291abbb929f91beaaa51844d790b23259134efa

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.}

[N6REJ]

RTC

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.}

[N6REJ]

RTC

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.}

[fancyFranci]

I would really like to merge it, but regex with this size are tricky and need more tests. I'm wondering where the underscore in the first regex went? But 4.3 has the time to test intensively, so I'm moving the PR.

[brianteeman]

There will be zero extra tests. Look at who has already tested it.

[obuisard]

As @fancyFranci noticed, it does not allow underscore in the regexp anymore. A file name like joomla_78.min.css will fail. Why are the regular expressions different in create/rename? Shouldn't they be identical?

[bembelimen]

Sorry, don't want to be the party pooper again. So I tested it:

Before:

Edit/Create file:

• _bla.scss => works
• bla.min.css => does not work
• text-file.php => works
• .hui.txt => converted to "hui.txt" andsaved (should probably give an error)

After:

Create file:

• _bla.scss => does not work
• bla.min.css => works
• text-file.php => does not work
• .hui.txt => converted to "hui.txt"

Edit file:

• _bla.scss => works
• bla.min.css => does not work
• text-file.php => works
• .hui.txt => converted to "hui.txt" and saved

I also think I was wrong regaring the "." at the beginning, there is no test needed as the getCmd filter already removed the ".". So I think (?!.*\\..*\\..*) is not needed at the beginning?

[bembelimen]

Back to pending

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.}

[brianteeman]

Please make up your minds.

Closed

[bembelimen]

My intention was not to block it :( just giving it a proper testing as I think it's a nice feature.