Anubhav RaiandClaude Opus 5 14b345c333 engine: a template's footage entry can't name a file outside the folder (#2123) ...

EffectCraft writes its own templates as `media/<item id>/<file>` entries, and
extraction trusted both halves. `base_name` splits on `/` and `\`, but the item
id was taken with `split('/')` alone, and it is pasted in front of a base name
another item already used. So a second `media/..\..\..\Startup\x/clip.mp4`
entry became `<dir>/..\..\..\Startup\x-clip.mp4`, which on Windows is three
folders up, with the attacker choosing how the name ends.

The id is now used only when it is one, and the name goes through
`safe_file_name`: separators, drive colons and NUL become `_`, and `.` / `..`
become `footage`. Reached from `templates.create` with `path`, from File ▸ New
from Template, and from a template dropped in the user Templates folder.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-10-27 23:34:41 +05:30

..

presets

Gap 7: Backgrounds animation presets (#1096)

2026-10-12 21:13:05 +02:00

scripts

M13.1: ScriptUI frontend (dialogs, palettes, dockable panels), script menus, example plug-in, docs

2026-10-03 04:24:01 -04:00

src

engine: a template's footage entry can't name a file outside the folder (#2123)

2026-10-27 23:34:41 +05:30

tests/it

CI: dev-profile gate, one test binary per crate, nextest, line tables only (#2235)

2026-10-23 12:59:51 -04:00

Cargo.toml

Use chrono instead of hand-rolled UTC conversion (#2023)

2026-10-23 11:29:09 -04:00