#20634: Removing unallowed media chars in requests

Work Item: 20634

src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/MediaLibraryService.cs

@@ -20,6 +20,8 @@ namespace Orchard.MediaLibrary.Services {
         private readonly IStorageProvider _storageProvider;
         private readonly IEnumerable<IMediaFactorySelector> _mediaFactorySelectors;
 
+        private static char[] HttpUnallowed = new char[] { '<', '>', '*', '%', '&', ':', '\\', '?' };
+
         public MediaLibraryService(
             IOrchardServices orchardServices, 
             IMimeTypeProvider mimeTypeProvider,
@@ -120,6 +122,12 @@ namespace Orchard.MediaLibrary.Services {
         }
 
         public string GetUniqueFilename(string folderPath, string filename) {
+
+            // remove any char which is unallowed in an HTTP request
+            foreach (var unallowedChar in HttpUnallowed) {
+                filename = filename.Replace(unallowedChar.ToString(), "");
+            }
+
             // compute a unique filename
             var uniqueFilename = filename;
             var index = 1;