Comment 4 for bug 1615364

Revision history for this message
SirVer (sirver) wrote :

> I believe such a name will never be used

I used such names all the time when designing maps - even more so before the editor got undo/redo.

> Why should we implement the same thing twice?

We have to since there is no trusted path between editor and website. We have no guarantees that maps come out of the Editor and have not been changed. In fact there is at least one map uploaded to the website that has a README file inside the ZIP that is the wmf file - so the user zipped the map manually and did not let the map editor do it. Scenario maps actually *have* to be edited outside of the editor to add scripting - it is quite possible that a user also changes the elemental file then and changes the name.

> Show the maps name on the website like it is now, but add the original filename to the details table (File name: map 64x64.wmf) and deliver the map with the original file name.

I think this is fine but I would suggest that we add a super conservative check on the filename and reject it in the forms validation if it contains anything that is not uncontroversial. I would only allow "a-zA-z0123456789_", not even space. The user can then still choose the filename, but they have to adhere to stricter rules.