Using / in blueprint name makes it disappear (but not gone)

Issue Summary

Using a / in a blueprint name (and probably other reserved characters in filenames) causes it to disappear. File is not gone, but manual intervention is needed.

Replication

Create a blueprint, or rename an existing blueprint, to something with a / in the name (for example; “Single site w/ WPMigrate”)
LocalWP will call the file “Single site w/ WPMigrate.zip” and therefore create a folder named “Single site w” and place a file called " WPMigrate.zip" in it.
The interface then no longer shows the blueprint (as it doesn’t scan sub-folders, presumably).

Solution for the user:

Go to the blueprint storage (~/Library/Application Support/Local/blueprints, on a mac) and fix the issue;
move and rename the file “Single site w/ WPMigrate.zip” to “Single site with WPMigrate.zip”
remove the now empty directory “Single site w”

Solution in the application:

Sanitise the input.

(Because yes, the blueprint name “…/…/…/…/MyBlueprint” will create a file MyBlueprint.zip in the user folder; path traversal vulnerability)

System Details

Version: 6.7.0+6347
Hardware: Macbook Pro M1Max
OS: Macos Ventura 13.2.1

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.