Item_Model::rename() cannot accept new filenames that contain "/"

2 files changed, 19 insertions, 0 deletions

diff --git a/core/models/item.php b/core/models/item.php
index 2d53ca0b..8ad22721 100644
--- a/core/models/item.php
+++ b/core/models/item.php
@@ -165,6 +165,10 @@ class Item_Model extends ORM_MPTT {
       return;
     }
 
+    if (strpos($new_name, "/")) {
+      throw new Exception("@todo NAME_CANNOT_CONTAIN_SLASH");
+    }
+
     $old_relative_path = $this->relative_path();
     $new_relative_path = dirname($old_relative_path) . "/" . $new_name;
     @rename(VARPATH . "albums/$old_relative_path", VARPATH . "albums/$new_relative_path");
diff --git a/core/tests/Item_Model_Test.php b/core/tests/Item_Model_Test.php
index 40915360..615b8997 100644
--- a/core/tests/Item_Model_Test.php
+++ b/core/tests/Item_Model_Test.php
@@ -125,4 +125,19 @@ class Item_Model_Test extends Unit_Test_Case {
     $this->assert_equal("resize", file_get_contents($photo->resize_path()));
     $this->assert_equal("file", file_get_contents($photo->file_path()));
   }
+
+  public function item_rename_wont_accept_slash_test() {
+    // Create a test photo
+    $item = self::create_random_item();
+
+    $new_name = rand() . "/";
+
+    try {
+      $item->rename($new_name)->save();
+    } catch (Exception $e) {
+      // pass
+      return;
+    }
+    $this->assert_false(true, "Item_Model::rename should not accept / characters");
+  }
 }