» Dateinamen filtern - Sonderzeichen usw entfernen

Zitat

Use any character in the current code page for a name, including Unicode characters and characters in the extended character set (128–255), except for the following:

...

• Integer value zero, sometimes referred to as the ASCII NUL character.
• Characters whose integer representations are in the range from 1 through 31

Zitat

BTRFS 255 bytes
exFAT 255 UTF-16 characters
ext2 255 bytes
ext3 255 bytes
ext3cow 255 bytes
ext4 255 bytes
FAT32 8.3 (255 UCS-2 code units with VFAT LFNs)
NTFS 255 characters
XFS 255 bytes

function filter_filename($filename) {
	// remove illegal file system characters https://en.wikipedia.org/wiki/Filename#Reserved_characters_and_words
	$filename = str_replace(array_merge(
		array_map('chr', range(0, 31)),
		array('<', '>', ':', '"', '/', '\\', '|', '?', '*')
		), '', $filename);
	// maximum filename length of 255 bytes http://serverfault.com/a/9548/44086
	$ext = pathinfo($filename, PATHINFO_EXTENSION);
	$filename = mb_strcut(pathinfo($filename, PATHINFO_FILENAME), 0, 255 - ($ext ? strlen($ext) + 1 : 0), mb_detect_encoding($filename)) . ($ext ? '.' . $ext : '');
	return $filename;
}

NotExist' onerror='alert(1).jpg

htmlspecialchars()

ENT_QUOTES

<img src='NotExist' onerror='alert(1)' />

function filter_filename($filename, $beautify=true) {
	// sanitize filename
	$filename = preg_replace(
		'~
		[<>:"/\\|?*]|            # file system reserved https://en.wikipedia.org/wiki/Filename#Reserved_characters_and_words
		[\x00-\x1F]|             # control characters http://msdn.microsoft.com/en-us/library/windows/desktop/aa365247%28v=vs.85%29.aspx
		[\x7F\xA0\xAD]|          # non-printing characters DEL, NO-BREAK SPACE, SOFT HYPHEN
		[#\[\]@!$&\'()+,;=]|     # URI reserved https://tools.ietf.org/html/rfc3986#section-2.2
		[{}^\~`]                 # URL unsafe characters https://www.ietf.org/rfc/rfc1738.txt
		~x',
		'-', $filename);
	// avoids ".", ".." or ".hiddenFiles"
	$filename = ltrim($filename, '.-');
	// optional beautification
	if ($beautify) $filename = beautify_filename($filename);
	// general maximum filename length is 255 bytes http://serverfault.com/a/9548/44086
	// we maximise to 200 bytes as windows includes the path https://msdn.microsoft.com/en-us/library/windows/desktop/aa365247(v=vs.85).aspx#maxpath
	$ext = pathinfo($filename, PATHINFO_EXTENSION);
	$filename = mb_strcut(pathinfo($filename, PATHINFO_FILENAME), 0, 200 - ($ext ? strlen($ext) + 1 : 0), mb_detect_encoding($filename)) . ($ext ? '.' . $ext : '');
	return $filename;
}

• die nicht sichtbaren Zeichen "DEL", "NO-BREAK-SPACE" und "SOFT HYPHEN"
• die Dateinamen ".", "..", da sie in Linux für das aktuelle bzw. das darüber liegende Verzeichnis stehen
• alle Dateien die mit "." beginnen, da es sich dabei in Linux um versteckte Dateien handelt
• der Dateiname wird auf 200 statt 255 Bytes gekürzt, da in Windows auch der Pfadname Platz benötigt

beautify_filename()

function beautify_filename($filename) {
	// reduce consecutive characters
	$filename = preg_replace(array(
		// remove whitespace
		'/ +/',
		// remove underline
		'/_+/',
		// "file---name.zip" becomes "file-name.zip"
		'/-+/'
	), '-', $filename);
	$filename = preg_replace(array(
		// "file-.-.-.-name..zip" becomes "file...name..zip"
		'/-?\.-?/',
		// "file...name..zip" becomes "file.name.zip"
		'/\.{2,}/'
	), '.', $filename);
	// lowercase for windows/unix interoperability http://support.microsoft.com/kb/100625
	$filename = mb_strtolower($filename, mb_detect_encoding($filename));
	// ".file-name.-" becomes "file-name"
	$filename = trim($filename, '.-');
	return $filename;
}

Dateiname, dateiname, DateiName, dateiName, usw

function filter_filename($filename) {
    $filename = preg_replace(
        '~
        [<>:"/\\|?*]|            # file system reserved https://en.wikipedia.org/wiki/Filename#Reserved_characters_and_words
        [\x00-\x1F]|             # control characters http://msdn.microsoft.com/en-us/library/windows/desktop/aa365247%28v=vs.85%29.aspx
        [\x7F\xA0\xAD]|          # non-printing characters DEL, NO-BREAK SPACE, SOFT HYPHEN
        [#\[\]@!$&\'()+,;=]|     # URI reserved https://tools.ietf.org/html/rfc3986#section-2.2
        [{}^\~`]                 # URL unsafe characters https://www.ietf.org/rfc/rfc1738.txt
        ~xu',
        '', $filename);
    // avoids ".", ".." or ".hiddenFiles"
    $filename = ltrim($filename, '.');
    // maximize filename length to 255 bytes http://serverfault.com/a/9548/44086
    $ext = pathinfo($filename, PATHINFO_EXTENSION);
    $len = $ext && ($ext = '.' . $ext) ? 255 - strlen($ext) : 255;
    return mb_strcut(pathinfo($filename, PATHINFO_FILENAME), 0, $len, mb_detect_encoding($filename)) . $ext;
}

if (filter_filename($filename) != $filename) {
    exit('Error: Filename not allowed');
}

Mach mit!