From bfb83343796340037a48c8378f7d57f3c7ae1482 Mon Sep 17 00:00:00 2001
From: tian <11429339@qq.com>
Date: Fri, 8 May 2026 10:17:50 +0800
Subject: [PATCH] fix: read filename from Content-Disposition header bypassing
 Go sanitization

---
 internal/web/ui.go | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/internal/web/ui.go b/internal/web/ui.go
index d116457..654a8d6 100644
--- a/internal/web/ui.go
+++ b/internal/web/ui.go
@@ -4032,8 +4032,16 @@ func (u *UI) actionFaceGalleryImport(w http.ResponseWriter, r *http.Request) {
 	count := 0
 	for _, files := range r.MultipartForm.File {
 		for _, hdr := range files {
-			// webkitdirectory paths can have varying depth, extract last dir as person name
-			parts := strings.Split(strings.ReplaceAll(hdr.Filename, "\\", "/"), "/")
+			// Go 1.20+ sanitizes hdr.Filename to basename only, parse raw Content-Disposition for full path
+			cd := hdr.Header.Get("Content-Disposition")
+			fullPath := hdr.Filename
+			if idx := strings.LastIndex(cd, `filename="`); idx >= 0 {
+				start := idx + len(`filename="`)
+				if end := strings.IndexByte(cd[start:], '"'); end >= 0 {
+					fullPath = cd[start : start+end]
+				}
+			}
+			parts := strings.Split(strings.ReplaceAll(fullPath, "\\", "/"), "/")
 			if len(parts) < 2 {
 				continue
 			}