Fix Decap image filename validation

2026-09-04 12:00:49 -04:00
parent 52c2568ab9
commit 2d5cdc8878
3 changed files with 16 additions and 8 deletions
@@ -156,6 +156,12 @@ not accept executables, archives, HTML, scripts, or SVG uploads. Asset rights,
 alt text, crop, dimensions, and optimization remain operator review items even
 when the CMS accepts an upload.

+Decap's image widget applies its field `pattern` to the selected file's base
+name, not to the repository-relative media path. Keep that UI pattern limited
+to the approved raster filename extensions; enforce the full
+`public/images/uploads` path separately in the schema, verifier, and Gitea
+branch rules below.
+
 The media gallery lists only `public/images/uploads`, so the pilot seeds that
 directory with the images referenced by CMS-controlled fields. Removing an
 image from content clears the field and uses the page's text-only or initials