Morning,
the abovementioned error happens as seen here: http://fchan.hentaiplanet.net/c/res/105.html
I already tried adding "\ " to the filename-parser, but it didn't change anything.
Note: I changed the script to include the original filename in the resulting filename, if necessary i can show those lines here.
Any ideas on how to fix this?
yes, but the thumbnailer get's it's panties in a bunch :P
I think the problem is your modifications... When you define external filestypes, Wakaba keeps the original filename, but still uses just a timestamp for the thumbnail. I recall doing this to avoid problems like this. Have a closer look at what the script does when there is an entry in %filetypes that matches the file extension, and try to get it to put the full name only in the filename and not in the thumbnail name.
Also, passing filenames you've received over the net onto external utilities is a very bad idea in general - somebody might sneak in some shell escape characters to run commands on your server. Wakaba basically generates all files as timestamps, and then finally renames them to the original filename at the end, if necessary. I suggest you do something similar.
ok, i fixed it now, for anyone interested, here's the original modification to wakaba.pl:
my $tempfilename=$uploadname;
$tempfilename=~s!^.*[\\/]!!; # cut off any directory in filename
$tempfilename=~s/[#<>%"'&]/_/g; # remove special characters from filename
my $filename=IMG_DIR.$filebase.'_'.$tempfilename;
my $thumbnail=THUMB_DIR.$filebase."s.jpg";
and here's another modification that was needed in wakautils.pl:
$convert -size ${width}x${height} -geometry ${width}x${height}! -quality $quality "$magickname" "$thumbnail";
the security matter is handled by removing characters that could allow exploits, i'm not very knowledgeable on this matter, so if i'm missing any, feel free to tell me so :)
Due to differences between shells and the various fairly complex features of them, I thought it was safest to not assume that I know which characters can be used to exploit, and just never pass the filename to through the shell. I think this is the best solution overall.
Basically, save the file with a timestamp name, generate a timestamp-named thumbnail, and finally rename the file (and only the file, no need to rename the thumbnail) to the name you want. Look at the current code to see how I do that.