diff --git a/client/components/cards/attachments.js b/client/components/cards/attachments.js index 43ae0e71c..8a6b73072 100644 --- a/client/components/cards/attachments.js +++ b/client/components/cards/attachments.js @@ -292,13 +292,16 @@ Template.cardAttachmentsPopup.events({ let uploads = []; for (const file of files) { const fileId = new ObjectID().toString(); - // If filename is not same as sanitized filename, has XSS, then cancel upload - if (file.name !== DOMPurify.sanitize(file.name)) { - return false; + const fileName = DOMPurify.sanitize(file.name); + + if (fileName !== file.name) { + console.warn('Detected possible XSS in file: ', file.name + '. Renamed to: ', fileName + '.'); } + const config = { file: file, fileId: fileId, + fileName: fileName, meta: Utils.getCommonAttachmentMetaFrom(card), chunkSize: 'dynamic', };