API: Don't allow dots in URL segments

silverstripe · Mar 30, 2013 · 5ec85d0 · 5ec85d0
1 parent b90eafa
commit 5ec85d0
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 7 deletions.
diff --git a/model/URLSegmentFilter.php b/model/URLSegmentFilter.php
@@ -30,10 +30,10 @@ class URLSegmentFilter extends Object {
 		'/&amp;/u' => '-and-',
 		'/&/u' => '-and-',
 		'/\s/u' => '-', // remove whitespace
-		'/_/u' => '-', // underscores to dashes
-		'/[^A-Za-z0-9+.\-]+/u' => '', // remove non-ASCII chars, only allow alphanumeric plus dash and dot
+		'/[_.]+/u' => '-', // underscores and dots to dashes
+		'/[^A-Za-z0-9+\-]+/u' => '', // remove non-ASCII chars, only allow alphanumeric and dashes
 		'/[\-]{2,}/u' => '-', // remove duplicate dashes
-		'/^[\.\-_]/u' => '', // Remove all leading dots, dashes or underscores
+		'/^[\-_]/u' => '', // Remove all leading dashes or underscores
 	);
 
 	/**
@@ -69,8 +69,8 @@ public function filter($name) {
 		$replacements = $this->getReplacements();
 
 		// Unset automated removal of non-ASCII characters, and don't try to transliterate
-		if($this->getAllowMultibyte() && isset($replacements['/[^A-Za-z0-9+.\-]+/u'])) {
-			unset($replacements['/[^A-Za-z0-9+.\-]+/u']);
+		if($this->getAllowMultibyte() && isset($replacements['/[^A-Za-z0-9+\-]+/u'])) {
+			unset($replacements['/[^A-Za-z0-9+\-]+/u']);
 		}
 
 		foreach($replacements as $regex => $replace) {

diff --git a/tests/model/URLSegmentFilterTest.php b/tests/model/URLSegmentFilterTest.php
@@ -26,7 +26,7 @@ public function testTransliteratesNonAsciiUrls() {
 	public function testReplacesCommonNonAsciiCharacters() {
 		$f = new URLSegmentFilter();
 		$this->assertEquals(
-			urlencode('aa1-.'),
+			urlencode('aa1-'),
 			$f->filter('Aa1~!@#$%^*()_`-=;\':"[]\{}|,./<>?')
 		);
 	}
@@ -56,5 +56,10 @@ public function testReplacements() {
 			$f->filter('Tim&Struppi')
 		);
 	}
-
+
+	public function testReplacesDots() {
+		$filter = new URLSegmentFilter();
+		$this->assertEquals('url-contains-dot', $filter->filter('url-contains.dot'));
+	}
+
 }