Uploading attachment with invalid file name returns HTTP 200

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Describe the bug
When uploading an attachment as described in the docs with a file name that contains a / the file is accepted but the file name is altered: The file name will be only the part after the last /.

To Reproduce
Steps to reproduce the behavior:

1. Create a card
2. Upload an attachment with file name foo/bar/example.pdf (curl -u <User>:<AppPassword> --basic -F "file=@<local-sample-file-name>;filename=foo/bar/example.pdf" -F "type=file" https://<your-instance-FQDN>/apps/deck/api/v1.0/boards/<boardId>/stacks/<stackId>/cards/<cardId>/attachments)
3. Check the attachments
4. See a file "example.pdf"

Expected behavior
I expect an HTTP status code 400 to be thrown as I provided an invalid file name. Since I receive an HTTP status code 200, I assume that my request has been processed as I submitted it.

Screenshots
See above.

Client details:
Not applicable

Background:
I use a programm to upload attachments. I prefix the attachments with the card id to prevent duplicates. Due to a bug in my application the absolute path of the file to upload was used for the upload request. Example:

• Absolute file path: /root/foo.pdf
• Card ID: 50
  Expected file name in request: 50_foo.pdf
  Actual (due bug) file name in request: 50_/root/foo.pdf
  Result in Nextcloud Deck: foo.pdf, foo (1).pdf, foo (2).pdf, ...

No errors have been found.

If you have access to your command line run e.g.:
sudo -u www-data php occ app:list
from within your Nextcloud installation folder

Nothing regarding deck.

Not applicable

Start at the Deck attachment upload API endpoint shown in the reproduction command and reproduce the request with the filename foo/bar/example.pdf. Check the upload response and stored attachment name; done means invalid filenames receive HTTP 400 rather than HTTP 200 and are not silently reduced to example.pdf.