Feature Proposal: Users should be able to choose the attachment file name

Motivation

It impedes TWiki acceptance if users are forced to rename their local files to comply with TWiki's upload rules. Decent renaming of suspicious file names can be done automatically.

Description

Sanitize the filename supplied by the upload form into a syntax which fits TWiki before writing the file to disk. Optionally allow the client to select the name of the TWiki attachment.

Hmmm.... automatic filtering.... This is the way Cairo did it. However, I haven't been able to figure out why it has been changed to throw an exception in Dakar. I guess I have missed something...

-- HaraldJoerg - 30 Sep 2005

Impact and Available Solutions

I don't have a patch ready and would prefer to patch DakarRelease only should this feature been considered worthwile.

Documentation

An optional field in the attach form gives the name under which the uploaded file should be saved. If missing, TWiki uses the client's file names after removing all characters which aren't allowed by its security settings.

Implementation

Looks like the change would be local to lib/TWiki/UI/Upload.pm and to some templates.

Discussion:

1. I think spaces should be allowed (they are very common, HTTP can handle them and compatibility is needed where the pub directory contents is not controlled by TWiki (i.e. for AutomaticAttachments)
2. Other characters (`#&'?|) could be stripped
   • Yet the idea of stripping them raises an interesting question for when they get stripped if AutomaticAttachment was the means through which the attachment got put in place.

-- MartinCleaver - 01 Oct 2005

Re Spaces in filenames: Though I personally hate spaces in filenames I admit that a space was exactly what caused the annoyance.

I think the explicit "Attach" processing and AutomaticAttachments deserve to be treated differently:

• Explicit Attach means: Take a file from my system to TWiki's system (in particular, its implementation of "Store"). My system and TWiki's can have a quite different syntax for filenames. So, for maximum usability (e.g. for updating the attachment) I would hope that TWiki remembers my filename verbatim regardless of whether this is a valid filename for TWiki's OS. TWiki, on the other hand, has to make sure that it stores the file under a name valid under the OS it is running on. Since TWiki is going to run under various systems it should definitely be a bit restrictive with the file name it uses for storing files. I wouldn't mind if TWiki eliminates spaces when writing files to its store.
• With AutomaticAttachments, the uploader has already solved the problem of finding a filename which is suitable for TWiki's OS. So I'd think there is no need to strip anything in this case.

PS: I ventured to add some lines at the very start of AutomaticAttachments to describe the purpose of the enhancement. Feel free to remove them again, but I admit that I had a hard time to figure out what all this Auto-attachment is about. But yes, I think it is an excellent idea because it allows me to symlink the attachment directory to some document vault and subsequently add helpful information about the files in the vault. Like writing an index.html for the directory, but somehow TWikier

-- HaraldJoerg - 04 Oct 2005

Thanks

-- MartinCleaver - 04 Oct 2005

See http://develop.twiki.org/~develop/cgi-bin/view/Bugs/Item822 for a fix for spaces in filenames. This needs more testing.

-- MartinCleaver - 02 Nov 2005