Safe Filenames
The safe-name setting reduces uploaded filenames to characters that behave predictably everywhere. It is on by default and should stay on.
Where to find it
Architect Panel → Configuration:
- Site Settings — the File Uploads and Audio/Video Conversion groups
What arrives in a filename
Whatever the user’s device allowed. Accented characters, non-Latin scripts, emoji, quotation marks, semicolons, path separators, and occasionally control characters.
All of these are legitimate on somebody’s machine and several of them are a problem on yours.
Why it matters beyond tidiness
- Path separators in a name are an attempt, deliberate or accidental, to write outside the intended directory.
- Control characters can truncate or disguise what a name appears to be.
- Names designed to look like something else — a long name whose visible portion suggests a different type.
Simplifying the name removes a class of problem rather than mitigating it.
It is not a substitute for the rest
A safe filename does not make a file safe. What matters equally is where it is stored, whether it can be executed, and how it is served back.
Private storage served through the platform, so permissions apply, is the control that does the heavy lifting.
Keep the original name somewhere
Users recognise their own filenames. Where the stored name is simplified, showing the original in the interface and using it on download keeps the file recognisable without storing it unsafely.
Watch out for collisions
Simplification can turn two different names into the same one. Confirm what happens when it does — a file silently replacing another is a data loss that nobody reports.
Test with a genuinely hostile name
Something containing a path separator, a quotation mark and a non-Latin script. Confirm it is stored under a name you are comfortable with and that it downloads correctly.
Do not turn it off for convenience
The usual reason is that somebody wants exact filenames preserved for an integration. Solve that by keeping the original name as data rather than by storing it as the actual name.
Worked example
An organisation keeps safe names on and stores the user’s original filename alongside, displaying it in the interface and using it on download. A test upload containing a path separator was stored under a simplified name, which is what the setting is for.
Recommendations
- Leave it on, always.
- Keep the original name as data, not as the stored name.
- Check what happens on a collision.
- Remember storage and serving matter more.