octobercms/october · warning · ApplicationException

editor::lang.filesystem.invalid_name

Error message

editor::lang.filesystem.invalid_name

What it means

After path validation, editorCreateDirectory runs validateFileSystemName() on the new name. This is stricter than the path validator: it allows only /^[\@0-9a-z.\s_-]+$/i - crucially no slash - and rejects '..'. So a name that looks like a path (contains '/') fails with editor::lang.filesystem.invalid_name.

Source

Thrown at modules/editor/traits/FileSystemFunctions.php:39

    {
        if (!strlen($basePath)) {
            throw new SystemException('The directory base path must not be empty');
        }

        if (!strlen($newName)) {
            throw new ApplicationException(Lang::get('editor::lang.filesystem.directory_name_cant_be_empty'));
        }

        if (!$this->validateFileSystemPath($newName)) {
            throw new ApplicationException(Lang::get('editor::lang.filesystem.invalid_path'));
        }

        if (strlen($parent) && !$this->validateFileSystemPath($parent)) {
            throw new ApplicationException(Lang::get('editor::lang.filesystem.invalid_path'));
        }

        if (!$this->validateFileSystemName($newName)) {
            throw new ApplicationException(Lang::get('editor::lang.filesystem.invalid_name'));
        }

        $newFullPath = $basePath.'/'.$parent.'/'.$newName;
        if (file_exists($newFullPath) && is_dir($newFullPath)) {
            throw new ApplicationException(Lang::get('editor::lang.filesystem.already_exists'));
        }

        if (!File::makeDirectory($newFullPath, 0755, true, true)) {
            throw new ApplicationException(Lang::get(
                'editor::lang.filesystem.error_creating_directory',
                ['name' => $newName]
            ));
        }
    }

    /**
     * editorRenameFileOrDirectory
     */

View on GitHub (pinned to b608633a7e)

Solutions

  1. Split the value: last segment goes in newName, the rest goes in parent.
  2. Remove characters outside letters, digits, dot, space, underscore, hyphen and '@'.
  3. Transliterate non-ASCII names before submission.
  4. Add a client-side pattern check matching ^[@0-9a-zA-Z.\s_-]+$ on the input.

Example fix

// before
newName: 'assets/partials', parent: ''

// after
newName: 'partials', parent: 'assets'
Defensive patterns

Strategy: validation

Validate before calling

/** Editor name rule: no slash, no '..', whitelist chars only. */
function isValidEditorName(string $name): bool
{
    if (!preg_match('/^[\@0-9a-z\.\s_\-]+$/i', $name)) {
        return false;
    }
    return strpos($name, '..') === false;
}

Prevention

When it happens

Trigger: Submitting 'assets/partials' as the directory name (slash not allowed in a name); a name containing characters such as '#', '&', parentheses; a name that includes '..' even as part of something like 'my..dir'.

Common situations: Users entering a full relative path in the single name field instead of using the parent field; names with special characters from copy-paste; non-latin alphabet names.

Related errors

AI-assisted analysis of octobercms/october@b608633a7e (2026-08-21). Data as JSON: /api/errors/c0f18180fbf6368a. Report an issue: GitHub.