Filename sanitization rules are inconsistent about kirby HOT 1 CLOSED

I found another inconsistency between server and client side. Str::slug() which is used by F::safeBasename() does

// trim leading and trailing non-word-chars

and uses a-z0-9 in its regex pattern on the server (source). The slug helper in the panel Vue code on the other hand, which should also

// trim leading and trailing non-word-chars

uses the passed allowed character set (new RegExp('^[^' + allowed + ']+', 'g')) in its regex pattern (source).

So you can enter something like _test.jpg in the panel when renaming and uploading a file, but the file will be saved as test.jpg.

Since the panel can’t handle files starting with underscores (for some reason) I would opt to use the more restrictive pattern.

from kirby.