Merged in feature/81-dev-dev01 (pull request #5)

auto-patch  81-dev-dev01-2023-12-05T22_45_26

* auto-patch  81-dev-dev01-2023-12-05T22_45_26

wp/wp-content/plugins/contact-form-7/includes/formatting.php

@@ -275,6 +275,17 @@ function wpcf7_sanitize_unit_tag( $tag ) {
 function wpcf7_antiscript_file_name( $filename ) {
 	$filename = wp_basename( $filename );
 
+	// Apply part of protection logic from sanitize_file_name().
+	$filename = str_replace(
+		array(
+			'?', '[', ']', '/', '\\', '=', '<', '>', ':', ';', ',', "'", '"',
+			'&', '$', '#', '*', '(', ')', '|', '~', '`', '!', '{', '}',
+			'%', '+', '’', '«', '»', '”', '“', chr( 0 )
+		),
+		'',
+		$filename
+	);
+
 	$filename = preg_replace( '/[\r\n\t -]+/', '-', $filename );
 	$filename = preg_replace( '/[\pC\pZ]+/iu', '', $filename );