diff options
Diffstat (limited to 'django/http')
| -rw-r--r-- | django/http/multipartparser.py | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/django/http/multipartparser.py b/django/http/multipartparser.py index ddf7cfa2f6..c3cb90e639 100644 --- a/django/http/multipartparser.py +++ b/django/http/multipartparser.py @@ -320,6 +320,8 @@ class MultiPartParser: file_name = html.unescape(file_name) file_name = file_name.rsplit('/')[-1] file_name = file_name.rsplit('\\')[-1] + # Remove non-printable characters. + file_name = ''.join([char for char in file_name if char.isprintable()]) if file_name in {'', '.', '..'}: return None |