From e1cf2a3e4630a1e871a22a39bc65548ed2044c54 Mon Sep 17 00:00:00 2001
From: Edwin Noorlander <edwin@noorlander.info>
Date: Tue, 11 Nov 2025 18:10:26 +0100
Subject: [PATCH] Sanitize image file names to remove special characters; fix
 existing image paths

---
 collections.sqlite                            | Bin 20480 -> 20480 bytes
 ...d74d6b90_D&D.jpg => 69136d74d6b90_D_D.jpg} | Bin
 ...peg => 69136da8e5916_Edwin_Gabrielle.jpeg} | Bin
 src/Controllers/ItemController.php            |   3 ++-
 4 files changed, 2 insertions(+), 1 deletion(-)
 rename public/uploads/{69136d74d6b90_D&D.jpg => 69136d74d6b90_D_D.jpg} (100%)
 rename public/uploads/{69136da8e5916_Edwin&Gabrielle.jpeg => 69136da8e5916_Edwin_Gabrielle.jpeg} (100%)

diff --git a/collections.sqlite b/collections.sqlite
index 8c5ed08e542e7d45a5f87dc880ac22180b196db8..6617853773b3c039d8f4f0b464ccfb11fb24a658 100644
GIT binary patch
delta 46
zcmZozz}T>Wae_3X!bBNoMum+D&i;(?lb85=h{U@mCKY9-=H#U6Wfi2R7pJ5!FaQ8v
CN)Gw}

delta 46
zcmZozz}T>Wae_3X+(a2?M!Ag%&i;&Qlb85=h^V<ICKY9-=H#U6Wfi2R7pJ5!FaQ8k
Cf)0cL

diff --git a/public/uploads/69136d74d6b90_D&D.jpg b/public/uploads/69136d74d6b90_D_D.jpg
similarity index 100%
rename from public/uploads/69136d74d6b90_D&D.jpg
rename to public/uploads/69136d74d6b90_D_D.jpg
diff --git a/public/uploads/69136da8e5916_Edwin&Gabrielle.jpeg b/public/uploads/69136da8e5916_Edwin_Gabrielle.jpeg
similarity index 100%
rename from public/uploads/69136da8e5916_Edwin&Gabrielle.jpeg
rename to public/uploads/69136da8e5916_Edwin_Gabrielle.jpeg
diff --git a/src/Controllers/ItemController.php b/src/Controllers/ItemController.php
index 5d6314c..4a9fea1 100755
--- a/src/Controllers/ItemController.php
+++ b/src/Controllers/ItemController.php
@@ -159,7 +159,8 @@ class ItemController
         if (!is_dir($uploadDir)) {
             mkdir($uploadDir, 0755, true);
         }
-        $fileName = uniqid() . '_' . basename($file['name']);
+        $safeName = preg_replace('/[^a-zA-Z0-9_\-\.]/', '_', basename($file['name']));
+        $fileName = uniqid() . '_' . $safeName;
         $targetPath = $uploadDir . $fileName;
         error_log("Attempting to move from " . $file['tmp_name'] . " to " . $targetPath);
         if (move_uploaded_file($file['tmp_name'], $targetPath)) {