From 797688c3f675082d6b8063ee595187a9bf5deb78 Mon Sep 17 00:00:00 2001
From: Ivan Bochkarev <ivanx86@gmail.com>
Date: Mon, 27 Jul 2026 17:13:21 +0600
Subject: [PATCH] fix #16663: keep double dots in browser filenames

Stop stripping dots that are not followed by a word character in
Browser::sanitize(). Names like somefile..txt stay intact; path
traversal remains Flysystem's job.
---
 .../Browser/BrowserSanitizeTest.php           | 64 +++++++++++++++++++
 .../Revolution/Processors/Browser/Browser.php |  8 ++-
 2 files changed, 69 insertions(+), 3 deletions(-)
 create mode 100644 _build/test/Tests/Processors/Browser/BrowserSanitizeTest.php

diff --git a/_build/test/Tests/Processors/Browser/BrowserSanitizeTest.php b/_build/test/Tests/Processors/Browser/BrowserSanitizeTest.php
new file mode 100644
index 00000000000..ef30661eb18
--- /dev/null
+++ b/_build/test/Tests/Processors/Browser/BrowserSanitizeTest.php
@@ -0,0 +1,64 @@
+<?php
+
+/*
+ * This file is part of the MODX Revolution package.
+ *
+ * Copyright (c) MODX, LLC
+ *
+ * For complete copyright and license information, see the COPYRIGHT and LICENSE
+ * files found in the top-level directory of this distribution.
+ *
+ * @package modx-test
+ */
+
+namespace MODX\Revolution\Tests\Processors\Browser;
+
+use MODX\Revolution\MODxTestCase;
+use MODX\Revolution\Processors\Browser\File\Remove;
+
+/**
+ * Regression for #16663: Browser::sanitize must keep double dots inside filenames.
+ *
+ * @package modx-test
+ * @subpackage modx
+ * @group Processors
+ * @group BrowserProcessors
+ */
+class BrowserSanitizeTest extends MODxTestCase
+{
+    /** @var Remove */
+    private $processor;
+
+    /**
+     * @before
+     */
+    public function setUpFixtures()
+    {
+        parent::setUpFixtures();
+        $this->processor = new Remove($this->modx);
+    }
+
+    /**
+     * @dataProvider providerSanitize
+     * @param string $input
+     * @param string $expected
+     */
+    public function testSanitizePreservesFilenameDotsAndTrailingSlash($input, $expected)
+    {
+        $this->assertSame($expected, $this->processor->sanitize($input));
+    }
+
+    public function providerSanitize()
+    {
+        return [
+            'double dots in filename' => ['somefile..txt', 'somefile..txt'],
+            'directory plus double-dot file' => ['folder/somefile..txt', 'folder/somefile..txt'],
+            'preserves trailing slash for File/Create' => ['folder/', 'folder/'],
+            'collapses duplicate slashes' => ['folder//file.txt', 'folder/file.txt'],
+            'hidden file leading dot' => ['.htaccess', '.htaccess'],
+            'url-encoded filename' => ['some%20file..txt', 'some file..txt'],
+            'leaves relative parent segment for Flysystem' => ['../escape', '../escape'],
+            'leaves nested parent segment for Flysystem' => ['a/../b', 'a/../b'],
+        ];
+    }
+}
diff --git a/core/src/Revolution/Processors/Browser/Browser.php b/core/src/Revolution/Processors/Browser/Browser.php
index 867372d638d..fee71fb363f 100644
--- a/core/src/Revolution/Processors/Browser/Browser.php
+++ b/core/src/Revolution/Processors/Browser/Browser.php
@@ -1,4 +1,5 @@
 <?php
+
 /*
  * This file is part of the MODX Revolution package.
  *
@@ -10,7 +11,6 @@
 
 namespace MODX\Revolution\Processors\Browser;
 
-
 use MODX\Revolution\Processors\Processor;
 use MODX\Revolution\Sources\modMediaSource;
 
@@ -135,7 +135,10 @@ public function handleResponse($response)
 
 
     /**
-     * @param $file
+     * Soft-sanitize a browser path/filename for media-source operations.
+     * Keeps valid names like somefile..txt. Path traversal is enforced by Flysystem.
+     *
+     * @param string $file
      *
      * @return string
      */
@@ -146,7 +149,6 @@ public function sanitize($file)
         if (strpos($file, '.') === 0) {
             $file = preg_replace('/^(\.)([\s\/]*)(.*)/', '$1$3', $file);
         }
-        $file = preg_replace('/\.(?![\w\-\~\s])/u', '', $file);
         $file = preg_replace('/\/{2,}/', '/', $file);
         $file = strip_tags($file);