shortcut name can contain invalid characters

[individual-it]

Describe the bug

In the UI the user can type any character as the name of a shortcut, but as this name effectively becomes the filename the request fails

Steps to reproduce

1. create a new shortcut and type /../../a as the name

Expected behavior

the name should be filtered with the same rules as any other file-name

Actual behavior

the name is accepted by the webUI and send to the server.

/../../a results in the request PUT https://localhost:9200/remote.php/dav/a.url

<a href='something'>owncloud</a>' in the request PUT https://localhost:9200/remote.php/dav/spaces/9dbc278a-11d0-47e7-adfb-5079d990981a%244c510ada-c86b-4815-8820-42cdf82c3d51/%3Ca%20href%3Dsomething%3Eowncloud%3C/a%3E.url

Setup

Please describe how you started the server and provide a list of relevant environment variables or configuration files.

OCIS_INSECURE=true IDM_CREATE_DEMO_USERS=true PROXY_HTTP_ADDR=0.0.0.0:9200 OCIS_URL=https://localhost:9200  ./ocis-6.5.0-linux-amd64 server