Joomla! Issue Tracker - CMS

Download
Launch
Feeling Lucky

[#15466] - You have tried to upload file(s) that are not safe.

? ? ? Success

User tests: Successful: Unsuccessful:

avatar zero-24
zero-24
21 Apr 2017

Pull Request for Issue #8903

Summary of Changes

If there is no info returned from JInputFiles get() you have tryed to upload unsave content. -> Tell that to the user.

Testing Instructions

Try to upload a zip file containing php scripts e.g. a extension using com_media.

Expected result

Error message: You have tryed to upload a save file that is not save.

Actual result

No message

Documentation Changes Required

None.

avatar zero-24 zero-24 - open - 21 Apr 2017
avatar zero-24 zero-24 - change - 21 Apr 2017
Status New ⇒ Pending
avatar zero-24 zero-24 - change - 21 Apr 2017
Milestone Added:
avatar joomla-cms-bot joomla-cms-bot - change - 21 Apr 2017
Category ⇒ Administration com_media Language & Strings
avatar zero-24 zero-24 - change - 21 Apr 2017
Title
…
You have tryed to upload a save file that is not save.
You have tryed to upload file(s) that are not safe.
avatar zero-24 zero-24 - edited - 21 Apr 2017
avatar zero-24 zero-24 - change - 21 Apr 2017
Title
…
You have tryed to upload a save file that is not save.
You have tryed to upload file(s) that are not safe.
avatar zero-24 zero-24 - change - 21 Apr 2017
Labels Added: ? ?
avatar julienV
julienV - comment - 21 Apr 2017

this only fixes the issue for upload done in com_media, but not from other code using jinputfile get function... I still think raising an exception there is necessary, and here you should catch it instead of testing for empty $files

avatar zero-24
zero-24 - comment - 21 Apr 2017

i have just replyed to the other issue please open a PR with that exeption against the 4.0 branch and test the temp fix here. Thanks

avatar zero-24 zero-24 - change - 21 Apr 2017
Title
…
You have tryed to upload file(s) that are not safe.
You have tried to upload file(s) that are not safe.
avatar zero-24 zero-24 - edited - 21 Apr 2017
avatar zero-24 zero-24 - change - 21 Apr 2017
Title
…
You have tryed to upload file(s) that are not safe.
You have tried to upload file(s) that are not safe.
avatar franz-wohlkoenig
franz-wohlkoenig - comment - 22 Apr 2017

@zero-24 can you say a extension using com_media to test correctly?

avatar zero-24
zero-24 - comment - 22 Apr 2017

You can try to upload any extension (zip file) using com_media. I have tried a custom extension one.

avatar franz-wohlkoenig
franz-wohlkoenig - comment - 22 Apr 2017

@zero-24 can you give me a Name for an Extension using com_media?

avatar zero-24
zero-24 - comment - 22 Apr 2017

Ah than you missunderstood that. You should just try to upload a zip file containing a extension. (or any other PHP code)

Like the weblinks package. As this is marked as unsafe file. The extension itself do not matter :)

avatar franz-wohlkoenig
franz-wohlkoenig - comment - 22 Apr 2017

I have tested this item ✅ successfully on 1bc78ff

Tried upload com_patchtester.zip in "Media", got expected Error Message.

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/15466.

avatar franz-wohlkoenig franz-wohlkoenig - test_item - 22 Apr 2017 - Tested successfully
avatar joomla-cms-bot joomla-cms-bot - change - 22 Apr 2017
Milestone Removed:
avatar franz-wohlkoenig franz-wohlkoenig - change - 22 Apr 2017
Easy No ⇒ Yes
avatar franz-wohlkoenig
franz-wohlkoenig - comment - 22 Apr 2017

Please reassign Milestone 3.7.1. Was removed cause set "Easy Test" on "Yes".

avatar infograf768 infograf768 - change - 22 Apr 2017
Milestone Added:
avatar wilsonge wilsonge - change - 2 May 2017
Milestone Removed:
avatar brianteeman brianteeman - change - 8 Jun 2017
Milestone Added:
avatar brianteeman brianteeman - change - 8 Jun 2017
Milestone Added:
avatar brianteeman brianteeman - change - 8 Jun 2017
Milestone Removed:
avatar brianteeman brianteeman - change - 8 Jun 2017
Milestone Removed:
avatar zero-24
zero-24 - comment - 13 Aug 2017

Would be great to get some testers here? ;)

avatar wojsmol
wojsmol - comment - 13 Aug 2017

@zero-24 I will test this, give me one hour :)

avatar wojsmol wojsmol - test_item - 13 Aug 2017 - Tested successfully
avatar wojsmol
wojsmol - comment - 13 Aug 2017

I have tested this item ✅ successfully on 9304662

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/15466.

avatar zero-24
zero-24 - comment - 13 Aug 2017

Thanks.

avatar zero-24 zero-24 - change - 13 Aug 2017
Status Pending ⇒ Ready to Commit
Labels
avatar mbabker mbabker - change - 15 Aug 2017
Status Ready to Commit ⇒ Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 ⇒ 2017-08-15 12:15:21
Closed_By ⇒ mbabker
Labels Added: ?
avatar mbabker mbabker - close - 15 Aug 2017
avatar mbabker mbabker - merge - 15 Aug 2017

Add a Comment

Login with GitHub to post a comment