mirror of
https://github.com/storytold/effectcraft.git
synced 2026-10-27 19:47:12 -06:00
Each 'media/<item>/<file>' entry is written to '<template> Media/<item>/<file>' only when <item> is all digits and <file> is a plain file name (not empty, '.' or '..', no separators, and on Windows no drive, stream or device name), and the written path is checked to sit in an item folder of '<template> Media'. read_stored skips entries with absolute, drive or '..' names.