snprintf(lbuf, llen, "%s_name", param);
}
- /* The \ check should technically be needed for win32 systems only where
- * it is a valid path separator. However, IE in all it's wisdom always sends
- * the full path of the file on the user's filesystem, which means that unless
- * the user does basename() they get a bogus file name. Until IE's user base drops
- * to nill or problem is fixed this code must remain enabled for all systems. */
+ /* Pursuant to RFC 7578, strip any path components in the
+ * user-supplied file name:
+ * > If a "filename" parameter is supplied ... do not use
+ * > directory path information that may be present."
+ */
s = _basename(internal_encoding, filename);
if (!s) {
s = filename;