metsw24-max 578e4815b7 Treat ':' as a path separator in sanitize_filename on Windows (#2651) ...

On Windows a ':' ends a drive prefix or starts an NTFS stream name, so a filename such as "C:.." or "a.txt:stream" survived sanitize_filename and could replace the upload directory or write to an alternate data stream. Cut at ':' on Windows as well.

2026-10-27 18:16:21 -04:00

1.0 MiB

Raw Blame History

View Raw