From 0a4d1569fb68ab8fa79f47e13e0e436bf1bb7397 Mon Sep 17 00:00:00 2001
From: Moxie Marlinspike <moxie@thoughtcrime.org>
Date: Mon, 10 Apr 2017 09:14:59 -0700
Subject: [PATCH] Clean up file name some on save

Rusty Bird points out that we don't want the save action to create
files outside the parent or hidden files.

// FREEBIE
---
 src/org/thoughtcrime/securesms/util/SaveAttachmentTask.java | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/org/thoughtcrime/securesms/util/SaveAttachmentTask.java b/src/org/thoughtcrime/securesms/util/SaveAttachmentTask.java
index 21e9ea0f0d..a97b185b3a 100644
--- a/src/org/thoughtcrime/securesms/util/SaveAttachmentTask.java
+++ b/src/org/thoughtcrime/securesms/util/SaveAttachmentTask.java
@@ -181,6 +181,8 @@ public class SaveAttachmentTask extends ProgressDialogAsyncTask<SaveAttachmentTa
       fileName = base + "." + extension;
     }
 
+    fileName = new File(fileName).getName();
+
     int  i    = 0;
     File file = new File(outputDirectory, fileName);
 
@@ -189,6 +191,10 @@ public class SaveAttachmentTask extends ProgressDialogAsyncTask<SaveAttachmentTa
       file = new File(outputDirectory, fileParts[0] + "-" + (++i) + "." + fileParts[1]);
     }
 
+    if (file.isHidden()) {
+      throw new IOException("Specified name would not be visible");
+    }
+
     return file;
   }