sqlpage.persist_uploaded_file function / empty space in the file name

[SebastiendOrnano]

The filename of a file uploaded through sqlpage.persist_uploaded_file function include 2 spaces
2024-11-02 12h56m24s dOuTc69Z.png

When using the file in a carousel, datagrid or html component, it works.

But not in a table component

-- Display list of users
SELECT 'table' AS component, 
    'Liste des utilisateur'   AS title, 
    'View'           AS markdown,
    'Img'  as markdown,
    TRUE             AS sort, 
    TRUE             AS search;

SELECT       
   '![view picture]('||member_picture_L||')'  AS Img,
   member_last_name     AS Nom,
   member_first_name  AS Prénom,
   member_email       AS Email,
   member_category     AS Categorie,
   member_function as fonction,
   member_status as statut,
  '[Edit](member_edit_4.sql?member_id=' || member_id || ')     [Delete](member_delete_4.sql?member_id=' || member_id|| ')     [Pict](member_picture_insert_4.sql?member_id=' || member_id|| ')'    AS View
FROM members
WHERE member_last_name IS NOT NULL
ORDER BY created_at DESC;

It works only if the spaces are replaced by underscores in the filename (I did the test by changing the filename in the repository and the datebase).
2024-11-02_12h56m24s_dOuTc69Z.png
It seems logical since the spaces introduce a break in the path of the file.
There is perhaps a security issue to introduce white spaces in the name or there is perhaps a way to formulate the table no to be blocked ? But, if not, could it be possible to replace the spaces by underscores ?

anyway, thanks a lot for sqlpage

[lovasoa]

Hello, and thank you for this feedback !

I updated persist_uploaded_file, to generate url-safe file names.

What you can do with your existing file names that contain spaces is to manually url-encode them:

SELECT
    CONCAT (
        '![view picture](',
        replace(member_picture_L, ' ', '%20'),
        ')'
    ) AS Img
;

[SebastiendOrnano]

It works. Thanks