starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[PR #2691] [MERGED] Fix file names with URL control characters #3771

New Issue
Closed
opened 2026-04-25 00:17:00 +02:00 by adam · 0 comments
adam commented 2026-04-25 00:17:00 +02:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/advplyr/audiobookshelf/pull/2691
Author: @lkiesow
Created: 2/29/2024
Status: ✅ Merged
Merged: 3/12/2024
Merged by: @advplyr

Base: master ← Head: hash-in-filename

📝 Commits (1)

  • 987842e Fix file names with URL control characters

📊 Changes

1 file changed (+4 additions, -1 deletions)

View changed files

📝 server/utils/fileUtils.js (+4 -1)

📄 Description

This patch ensures that files names like series #3 xy.jpg are actually handled correctly instead of the part after # being interpreted as fragment and being discarded.

I noticed that in a few rare cases the App wouldn't properly display cover images. It turns out that due the file names containing a #, the file path got corrupted, causing Audiobookshelf to return a 403.

To reproduce the issue (there are likely more ways):

  1. Enable XAccel, e.g. by putting in the docker-compose.yml (even if you don't configure Nginx for this, you should still be able to confirm the issue): 
      audiobookshelf:
    image: ghcr.io/advplyr/audiobookshelf:2.8.0
    environment:
      - USE_X_ACCEL=/protected
  2. Upload a book with a path that includes a # like /data/audiobooks/Author/Series #1 - xy/cover.jpg
  3. Go into the web interface and try downloading the file. This will not work, but copy the URL. It should be something like:
    https://audiobook.example.com/api/items/87ee14eb-f2fc-412f-1213-69bf27ff3947/file/3954651/download?token=…`
  4. On the host system, communicate with the container directly, sending an HTTP request for the file. If you don't have a reverse proxy, you can just use the original URL: 
    % curl -i 'http://127.0.0.1:8081/api/items/87ee14eb-f2fc-412f-1213-69bf27ff3947/file/3954651/download?token=…'
HTTP/1.1 204 No Content
X-Accel-Redirect: /protected/audiobooks/Author/Series%20
    The redirect URL will end at the # character in the path. This will result in the file not being found.

The patch will fix the issue and the correct path will be returned.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/advplyr/audiobookshelf/pull/2691 **Author:** [@lkiesow](https://github.com/lkiesow) **Created:** 2/29/2024 **Status:** ✅ Merged **Merged:** 3/12/2024 **Merged by:** [@advplyr](https://github.com/advplyr) **Base:** `master` ← **Head:** `hash-in-filename` --- ### 📝 Commits (1) - [`987842e`](https://github.com/advplyr/audiobookshelf/commit/987842ed04e5a7e8025bdfc2ed576d9569eed8ec) Fix file names with URL control characters ### 📊 Changes **1 file changed** (+4 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `server/utils/fileUtils.js` (+4 -1) </details> ### 📄 Description This patch ensures that files names like `series #3 xy.jpg` are actually handled correctly instead of the part after `#` being interpreted as fragment and being discarded. I noticed that in a few rare cases the App wouldn't properly display cover images. It turns out that due the file names containing a `#`, the file path got corrupted, causing Audiobookshelf to return a 403. --- To reproduce the issue (there are likely more ways): 1. Enable XAccel, e.g. by putting in the `docker-compose.yml` (even if you don't configure Nginx for this, you should still be able to confirm the issue): ```yml audiobookshelf: image: ghcr.io/advplyr/audiobookshelf:2.8.0 environment: - USE_X_ACCEL=/protected ``` 2. Upload a book with a path that includes a `#` like `/data/audiobooks/Author/Series #1 - xy/cover.jpg` 3. Go into the web interface and try downloading the file. This will not work, but copy the URL. It should be something like: https://audiobook.example.com/api/items/87ee14eb-f2fc-412f-1213-69bf27ff3947/file/3954651/download?token=…` 4. On the host system, communicate with the container directly, sending an HTTP request for the file. If you don't have a reverse proxy, you can just use the original URL: ``` % curl -i 'http://127.0.0.1:8081/api/items/87ee14eb-f2fc-412f-1213-69bf27ff3947/file/3954651/download?token=…' HTTP/1.1 204 No Content X-Accel-Redirect: /protected/audiobooks/Author/Series%20 ``` The redirect URL will end at the `#` character in the path. This will result in the file not being found. The patch will fix the issue and the correct path will be returned. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2026-04-25 00:17:00 +02:00
adam closed this issue 2026-04-25 00:17:00 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#3771
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?