diff options
| author | John-Mark Bell <jmb@pexip.com> | 2016-03-07 12:06:46 +0000 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2016-03-07 13:22:11 -0500 |
| commit | 809eb5ddeeca388b2a1d339f7d5ee1f29119ecea (patch) | |
| tree | 772adf7d61f75f9c03c06392ed6d199f019f203a /django/http | |
| parent | 4702c1ac98b284cacffcf5fbb0db9b85f0c2f8ba (diff) | |
[1.9.x] Fixed #26325 -- Made MultiPartParser ignore filenames that normalize to an empty string.
Backport of 4b129ac81f4fa38004950d0b307f81d1e9b44af8 from master
Diffstat (limited to 'django/http')
| -rw-r--r-- | django/http/multipartparser.py | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/django/http/multipartparser.py b/django/http/multipartparser.py index 375584e4f3..67d0fc48d5 100644 --- a/django/http/multipartparser.py +++ b/django/http/multipartparser.py @@ -181,10 +181,11 @@ class MultiPartParser(object): elif item_type == FILE: # This is a file, use the handler... file_name = disposition.get('filename') + if file_name: + file_name = force_text(file_name, encoding, errors='replace') + file_name = self.IE_sanitize(unescape_entities(file_name)) if not file_name: continue - file_name = force_text(file_name, encoding, errors='replace') - file_name = self.IE_sanitize(unescape_entities(file_name)) content_type, content_type_extra = meta_data.get('content-type', ('', {})) content_type = content_type.strip() |