Issue 2377 – Avoid replacing %2F with a slash and %2E with a dot in special cases on upload to avoid path traversal

https://winscp.net/tracker/2377

Source commit: e95a501a6e32e51312c7641c6398734f8c00fc2a

source/core/CopyParam.cpp

@@ -631,9 +631,10 @@ UnicodeString __fastcall TCopyParamType::RestoreChars(UnicodeString FileName) co
       {
         UnicodeString Hex = FileName.SubString(Index + 1, 2);
         wchar_t Char = static_cast<wchar_t>(HexToByte(Hex));
-        if ((Char != L'\0') &&
+        if ((Char != L'\0') && (Char != L'/') &&
             ((FTokenizibleChars.Pos(Char) > 0) ||
-             (((Char == L' ') || (Char == L'.')) && (Index == FileName.Length() - 2))))
+             // not decoding lone dot
+             (((Char == L' ') || ((Char == L'.') && (Index > 1))) && (Index == FileName.Length() - 2))))
         {
           FileName[Index] = Char;
           FileName.Delete(Index + 1, 2);