{"record":{"id":"cd1c2733b12e01f0","repo":"octobercms/october","slug":"cms-lang-asset-invalid-name","errorCode":null,"errorMessage":"cms::lang.asset.invalid_name","messagePattern":"cms::lang\\.asset\\.invalid_name","errorType":"exception","errorClass":"ApplicationException","httpStatus":null,"severity":"error","filePath":"modules/media/widgets/MediaManager.php","lineNumber":415,"sourceCode":"    }\n\n    /**\n     * onApplyName renames an item\n     * @return array\n     */\n    public function onApplyName()\n    {\n        if (!$this->checkHasPermission('mediaDelete')) {\n            throw new ForbiddenException;\n        }\n\n        $newName = trim(Input::get('name'));\n        if (!strlen($newName)) {\n            throw new ApplicationException(Lang::get('cms::lang.asset.name_cant_be_empty'));\n        }\n\n        if (!$this->validateFileName($newName)) {\n            throw new ApplicationException(Lang::get('cms::lang.asset.invalid_name'));\n        }\n\n        $originalPath = Input::get('originalPath');\n        $originalPath = MediaLibrary::validatePath($originalPath);\n        $newPath = dirname($originalPath).'/'.$newName;\n        $type = Input::get('type');\n\n        if ($type === MediaLibraryItem::TYPE_FILE) {\n            // Validate extension\n            if (!$this->validateFileType($newName)) {\n                throw new ApplicationException(Lang::get('backend::lang.media.type_blocked'));\n            }\n\n            if (Config::get('media.clean_vectors', true) && $this->isVector($newName)) {\n                throw new ApplicationException(Lang::get('backend::lang.media.type_blocked'));\n            }\n\n            // Move single file","sourceCodeStart":397,"sourceCodeEnd":433,"githubUrl":"https://github.com/octobercms/october/blob/b608633a7e8922487d91a8161499020121c3b3bf/modules/media/widgets/MediaManager.php#L397-L433","documentation":"onApplyName validates the proposed name with MediaManager::validateFileName(), which rejects: (1) any path separator or Windows/URL-reserved character (regex ^[^/\\\\<>:\"|?*]+$ with /u — so invalid UTF-8 also fails it), (2) invisible/control characters (\\p{C}), and (3) names consisting entirely of dots ('.', '..'). Unlike the editor's path validator this allows most Unicode letters, but a slash, colon, quote, pipe, question mark, angle bracket, backslash, zero-width char, or dot-only name throws cms::lang.asset.invalid_name.","triggerScenarios":"Renaming to 'folder/file.txt' (embedded slash), 'name:v2.png', 'say \"hi\".txt', a name pasted from rich text containing a zero-width space, or attempting to rename to '.' or '..'.","commonSituations":"Users pasting names from Office/web that carry smart quotes or invisible marks; attempts to smuggle a path separator through the rename dialog; scripted bulk renames using unsanitized titles.","solutions":["Strip reserved characters and invisible marks before submitting: preg_replace('/[\\p{C}/\\\\<>:\"|?*]/u', '', $name)","Use a slug or a whitelist like preg_replace('/[^0-9a-z\\-_\\. ]/i', '', $name) for scripted renames","Pick a name that is not composed solely of dots"],"exampleFix":"// before — title straight from user input, may contain ':' or zero-width chars\n$response = $.request('onApplyName', { data: { name: title } });\n\n// after — sanitize first\nconst safe = title.replace(/[\\p{C}\\/\\\\<>:\"|?*]/gu, '').replace(/^\\.+$/, '').trim();\nif (safe) $.request('onApplyName', { data: { name: safe } });","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"function isValidMediaName(string $name): bool\n{\n    return (bool) preg_match('/^[^\\/\\\\<>:\"|?*]+$/u', $name)\n        && !preg_match('/\\p{C}/u', $name)\n        && !preg_match('/^\\.+$/', $name);\n}\n\n// usage: if (!isValidMediaName($newName)) { reject client-side }","tryCatchPattern":"try {\n    $widget->onApplyName();\n} catch (ApplicationException $e) {\n    // name_cant_be_empty vs invalid_name vs type_blocked each need different UI hints\n    Flash::error($e->getMessage());\n}","preventionTips":["Sanitize pasted names: strip separators, reserved chars and invisible marks before submit","Never allow '/', '\\\\', ':', '\"', '|', '?', '*', '<', '>' in user-supplied names","Block dot-only names ('.', '..') at the input layer"],"tags":["media","rename","filenames","validation","unicode"],"backgroundTag":"invalid-filename","analyzedSha":"b608633a7e8922487d91a8161499020121c3b3bf","analyzedAt":"2026-08-21T04:24:57.515Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}