[media] Special characters issue (#7386)

Solves an issue when if using special characters (&, <, >, ") the file download fails and the name of the file appears incorrectly in the browse tab of the media module.

The script removes the special characters from the sql data table media as well as from the file system.

modules/media/ajax/FileUpload.php

@@ -116,7 +116,7 @@ function uploadFile()
     // If required fields are not set, show an error
     if (empty($_FILES)) {
         showMediaError(
-            "File could not be uploaded successfully. 
+            "File could not be uploaded successfully.
             Please contact the administrator.",
             400
         );
@@ -129,7 +129,10 @@ function uploadFile()
 
     checkDateTaken($dateTaken);
 
-    $fileName  = preg_replace('/\s/', '_', $_FILES["file"]["name"]);
+    $fileName = preg_replace('/\s/', '_', $_FILES["file"]["name"]);
+    // urldecode() necessary to decode double quotes encoded automatically
+    // by chrome browsers to avoid XSS attacks
+    $fileName  = urldecode($fileName);
     $fileType  = $_FILES["file"]["type"];
     $extension = pathinfo($fileName)['extension'];
 
@@ -178,7 +181,7 @@ function uploadFile()
     if (move_uploaded_file($_FILES["file"]["tmp_name"], $mediaPath . $fileName)) {
         try {
             // Insert or override db record if file_name already exists
-            $db->insertOnDuplicateUpdate('media', $query);
+            $db->unsafeInsertOnDuplicateUpdate('media', $query);
             $uploadNotifier->notify(array("file" => $fileName));
         } catch (DatabaseException $e) {
             showMediaError("Could not upload the file. Please try again!", 500);

tools/single_use/Cleanup_Special_Chars_Media.php

@@ -0,0 +1,54 @@
+<?php
+/**
+ * This script is written to clean up the files with special characters from the media data table as well as clean up the
+ * quotes appearing as %22 in the file names in the file system
+ *
+ * To use the script: php Cleanup_Special_Chars_Media.php
+ *
+ *
+ * PHP Version 7
+ *
+ * @category Main
+ * @package Loris
+ * @author Pierre PAC SOO <pierre.pacsoo@mcin.ca>
+ * @license Loris license
+ * @link https://www.github.com/aces/Loris-Trunk/
+ */
+
+require_once __DIR__."/../generic_includes.php";
+$config = NDB_Config::singleton();
+
+$media_path = $config->getSetting('mediaPath');
+
+$data = $DB->pselect(
+    "SELECT id, file_name
+        FROM media",
+    []
+);
+
+foreach($data as $key => $file) {
+
+    // fileNameURLencoded is needed for the step line 48 as the file name got rid of '"' and replaced it with %22
+    // urldecode will get rid of %22 and replace it correctly for it to be inserted into the table
+    $fileNameURLencoded = htmlspecialchars_decode($file['file_name']);
+    $fileName = urldecode($fileNameURLencoded);
+
+    // update only if file name has been updated
+    if($fileName !== $file['file_name']) {
+
+        // change name in sql table media
+        $DB->unsafeupdate(
+            "media",
+            [
+                "file_name" => $fileName
+            ],
+            [
+                "id" => $file['id']
+            ]
+        );
+
+        // update name in file system
+        rename($media_path.$fileNameURLencoded, $media_path.$fileName);
+        print("Old file name: " . $file['file_name'] . ". New file name: " . $fileName . "\n\n");
+    }
+}