A critical vulnerability was discovered in React Server Components (Next.js). Our Systems Remain Fully Protected. Learn More

Per Nergård (MVP)
Jun 26, 2011
  4536
(0 votes)

Hot to add validation of folder names in CMS5 filemanager

After migration of a CMS4 site we started to get a lot of reports of links that had stopped working.

I remembered that we had trouble with non allowed characters in an other site some time ago.

A quick check and sure enough we had a problem with “&” characters in some of the folder names.

In CMS 6 a validation has been added to avoid these problems but not in a default CMS 5 R2site.

Luckily there is an easy fix. Replacing the standard

<virtualPath customFileSummary="~/FileSummary.config" /> row in web.config with the below adds the validation.

<virtualPath customFileSummary="~/FileSummary.config"  illegalCharactersRegex="%|&amp;|\+|/COM[0-9]([/\.]|$)|/LPT[0-9]([/\.]|$)|/PRN([/\.]|$)|/CLOCK\$([/\.]|$)|/AUX([/\.]|$)|/NUL([/\.]|$)|/CON([/\.]|$)|/.+\.$" illegalCharactersDisplayString="%,&amp;,+,COM,LPT,PRN,CLOCK$,AUX,CON,NUL,*.">

I don’t understand why this functionality isn’t activated by default in  CMS5 and a recommendation to anyone upgrading a pre CMS5 site is to go through all the folders and correct any incorrect folder names.

Jun 26, 2011

Comments

Linus Ekström
Linus Ekström Jun 27, 2011 07:12 AM

@Per: The & character became restricted in one of the later IIS versions that has a default setting to not allow characters that can be decoded several times. That why we added the & character to the list of unwanted characters first in the CMS 6 version. There is even the posibility to allow the "&"-character. See the original form thread about the issue here: http://world.episerver.com/Modules/Forum/Pages/thread.aspx?id=34240

Please login to comment.
Latest blogs
Jhoose Security Modules v2.6.0 — Added support for Permissions Policy and .NET 10

Version 2.6.0 adds Permissions Policy header support, updates to .NET 10, improved policy management, configurable security settings, and enhanced...

Andrew Markham | Dec 6, 2025 |

Building a 360° Customer Profile With AI: How Opal + Optimizely Unlock Predictive Personalization

Creating truly relevant customer experiences requires more than collecting data—it requires understanding it. Most organizations already have rich...

Sujit Senapati | Dec 4, 2025

Building a Lightweight Optimizely SaaS CMS Solution with 11ty

Modern web development often requires striking a difficult balance between site performance and the flexibility needed by content editors. To addre...

Minesh Shah (Netcel) | Dec 3, 2025

Creating Opal Tools Using The C# SDK

Over the last few months, my colleagues at Netcel and I have partaken in two different challenge events organised by Optimizely and centered around...

Mark Stott | Dec 3, 2025