Saving files with folder names is creating folders inside our storage

[pablodiegoss]

Describe the bug
Inside our markers folder, there is another marker folder, with a couple markers inside (recursive markers, looks like a marker created with another marker), and another marker folder, which has more markers inside

To reproduce the bug

• Not sure, probably downloading and reuploading the same marker multiple times recursively.
• Uploading files with / on the filename

Additional Information
Will probably be indirectly solved by #699

[vjpixel]

Review do PR #936

Verdict: ✅ Pronto pra merge.

• Aplica os.path.basename() em todos os clean_* que recebem upload:
  • UploadObjectForm.clean_source / clean_audio_description
  • UploadMarkerForm.clean_source (método novo, antes não existia)
  • SoundForm.clean_file
• Causa raiz confirmada: Storage.generate_filename no Django só sanitiza o basename via get_valid_name. Se o file.name traz /, o componente de diretório passa: upload_to="objects/" + "evil/path/file.gif" → "objects/evil/path/file.gif".
• Verificado:

  >>> f = SimpleUploadedFile("evil/path/file.gif", b"...")
  >>> form = UploadObjectForm(files={"source": f}, data={...})
  >>> form.is_valid(); form.cleaned_data["source"].name
  'file.gif'

CI verde. Risco zero — caminhos válidos (sem /) seguem inalterados.

---

Generated by Claude Code