octobercms/october · error · ApplicationException

cms::lang.asset.invalid_name

Error message

cms::lang.asset.invalid_name

What it means

onApplyName validates the proposed name with MediaManager::validateFileName(), which rejects: (1) any path separator or Windows/URL-reserved character (regex ^[^/\\<>:"|?*]+$ with /u — so invalid UTF-8 also fails it), (2) invisible/control characters (\p{C}), and (3) names consisting entirely of dots ('.', '..'). Unlike the editor's path validator this allows most Unicode letters, but a slash, colon, quote, pipe, question mark, angle bracket, backslash, zero-width char, or dot-only name throws cms::lang.asset.invalid_name.

Source

Thrown at modules/media/widgets/MediaManager.php:415

    }

    /**
     * onApplyName renames an item
     * @return array
     */
    public function onApplyName()
    {
        if (!$this->checkHasPermission('mediaDelete')) {
            throw new ForbiddenException;
        }

        $newName = trim(Input::get('name'));
        if (!strlen($newName)) {
            throw new ApplicationException(Lang::get('cms::lang.asset.name_cant_be_empty'));
        }

        if (!$this->validateFileName($newName)) {
            throw new ApplicationException(Lang::get('cms::lang.asset.invalid_name'));
        }

        $originalPath = Input::get('originalPath');
        $originalPath = MediaLibrary::validatePath($originalPath);
        $newPath = dirname($originalPath).'/'.$newName;
        $type = Input::get('type');

        if ($type === MediaLibraryItem::TYPE_FILE) {
            // Validate extension
            if (!$this->validateFileType($newName)) {
                throw new ApplicationException(Lang::get('backend::lang.media.type_blocked'));
            }

            if (Config::get('media.clean_vectors', true) && $this->isVector($newName)) {
                throw new ApplicationException(Lang::get('backend::lang.media.type_blocked'));
            }

            // Move single file

View on GitHub (pinned to b608633a7e)

Solutions

  1. Strip reserved characters and invisible marks before submitting: preg_replace('/[\p{C}/\\<>:"|?*]/u', '', $name)
  2. Use a slug or a whitelist like preg_replace('/[^0-9a-z\-_\. ]/i', '', $name) for scripted renames
  3. Pick a name that is not composed solely of dots

Example fix

// before — title straight from user input, may contain ':' or zero-width chars
$response = $.request('onApplyName', { data: { name: title } });

// after — sanitize first
const safe = title.replace(/[\p{C}\/\\<>:"|?*]/gu, '').replace(/^\.+$/, '').trim();
if (safe) $.request('onApplyName', { data: { name: safe } });
Defensive patterns

Strategy: type-guard

Type guard

function isValidMediaName(string $name): bool
{
    return (bool) preg_match('/^[^\/\\<>:"|?*]+$/u', $name)
        && !preg_match('/\p{C}/u', $name)
        && !preg_match('/^\.+$/', $name);
}

// usage: if (!isValidMediaName($newName)) { reject client-side }

Try / catch

try {
    $widget->onApplyName();
} catch (ApplicationException $e) {
    // name_cant_be_empty vs invalid_name vs type_blocked each need different UI hints
    Flash::error($e->getMessage());
}

Prevention

When it happens

Trigger: Renaming to 'folder/file.txt' (embedded slash), 'name:v2.png', 'say "hi".txt', a name pasted from rich text containing a zero-width space, or attempting to rename to '.' or '..'.

Common situations: Users pasting names from Office/web that carry smart quotes or invisible marks; attempts to smuggle a path separator through the rename dialog; scripted bulk renames using unsanitized titles.

Related errors

AI-assisted analysis of octobercms/october@b608633a7e (2026-08-21). Data as JSON: /api/errors/cd1c2733b12e01f0. Report an issue: GitHub.