Developer forum

Hi Jesper

Below the types not allowed and the normalization method of filenames - the latter depends on settings. This behavior cannot be changed.

if (file.FileName.EndsWith(".cshtml", StringComparison.OrdinalIgnoreCase) ||
                                file.FileName.EndsWith(".cshtm", StringComparison.OrdinalIgnoreCase) ||
                                file.FileName.EndsWith(".vbhtml", StringComparison.OrdinalIgnoreCase) ||
                                file.FileName.EndsWith(".vbhtm", StringComparison.OrdinalIgnoreCase) ||
                                file.FileName.EndsWith(".aspx", StringComparison.OrdinalIgnoreCase) ||
                                file.FileName.EndsWith(".ashx", StringComparison.OrdinalIgnoreCase) ||
                                file.FileName.EndsWith(".asmx", StringComparison.OrdinalIgnoreCase) ||
                                file.FileName.EndsWith(".soap", StringComparison.OrdinalIgnoreCase) ||
                                file.FileName.EndsWith(".axd", StringComparison.OrdinalIgnoreCase) ||
                                file.FileName.EndsWith(".rem", StringComparison.OrdinalIgnoreCase) ||
                                file.FileName.EndsWith(".asp", StringComparison.OrdinalIgnoreCase))
                        {
                            throw new Exception("Extension not allowed");
                        }

This is how we normalize the filename:

 private static string NormalizeFileName(string fileName)
        {
            fileName = fileName.Replace(",", "_");
            fileName = fileName.Replace(";", "_");
            fileName = fileName.Replace("+", "_");
            fileName = fileName.Replace("'", "_");
            fileName = fileName.Replace("#", "_");

            if (SystemConfiguration.Instance.GetBoolean("/Globalsettings/Modules/Filemanager/Upload/ReplaceSpace"))
            {
                fileName = fileName.Replace(" ", "-");
            }
            if (SystemConfiguration.Instance.GetBoolean("/Globalsettings/Modules/Filemanager/Upload/LatinNormalize"))
            {
                fileName = LatinNormalization.LatinToAscii(fileName);
                string extension = Path.GetExtension(fileName);
                fileName = string.Format("{0}{1}", Regex.Replace(Path.GetFileNameWithoutExtension(fileName), "[^a-z0-9_\\- ]", string.Empty, RegexOptions.IgnoreCase), extension);
            }
        }

The reasoning is of course possible security breach that could also be handled via configuration, but usually it is not, and we need to remove characters in the name as they prevent accessing the file in a browser etc.

BR Nicolai