No Code Attached Yet
avatar Webdongle
Webdongle
27 Aug 2020

Steps to reproduce the issue

Navigate to Content >>> Media ... Options
Change the 'Maximum size'
Save

Expected result

Get message saved

Actual result

Error
Invalid field: Path to Files Folder
Invalid field: Path to Images Folder

System information (as much as possible)

Wamp localhost

Additional comments

This only happens on Wamp localhost not on a remote Host
It happens on fresh 3.9.21 installs and sites updated to 3.9.21

Votes

# of Users Experiencing Issue
1/1
Average Importance Score
5.00

avatar Webdongle Webdongle - open - 27 Aug 2020
avatar joomla-cms-bot joomla-cms-bot - labeled - 27 Aug 2020
avatar SharkyKZ SharkyKZ - close - 28 Aug 2020
avatar SharkyKZ
SharkyKZ - comment - 28 Aug 2020

Please test PR #30502.

avatar SharkyKZ SharkyKZ - change - 28 Aug 2020
Status New Closed
Closed_Date 0000-00-00 00:00:00 2020-08-28 13:00:25
Closed_By SharkyKZ
avatar SharkyKZ SharkyKZ - change - 28 Aug 2020
Status Closed New
Closed_Date 2020-08-28 13:00:25
Closed_By SharkyKZ
avatar SharkyKZ SharkyKZ - reopen - 28 Aug 2020
avatar SharkyKZ
SharkyKZ - comment - 28 Aug 2020

@joomla/security Can you take a look at this? What's the logic in checking that path is equal to path put through JPath::clean()?

avatar zero-24
zero-24 - comment - 28 Aug 2020

It is intended to not be out of the root folder for example. What from the path did clean filter that causes the issue?

avatar SharkyKZ
SharkyKZ - comment - 28 Aug 2020

This line fails because JPath::check() runs path through JPath::clean() and then it's compared to original non-cleaned path:

return $value === $path;

So any slash/backslash or duplicate slash discrepancies fail here.

avatar zero-24
zero-24 - comment - 28 Aug 2020

So any slash/backslash or duplicate slash discrepancies fail here.

yes when it is not a valid path right?

avatar Webdongle
Webdongle - comment - 28 Aug 2020

It worked before the update. Can you compare how it was before and after the update then fix it?

avatar zero-24
zero-24 - comment - 28 Aug 2020

It worked before the update. Can you compare how it was before and after the update then fix it?

can you show me the value for that field that you use and that cause issues for you?

avatar Webdongle
Webdongle - comment - 28 Aug 2020

media options 03
Vhange value of Maximum Size (in MB) and save or just save. Only fails on wamp localhost not live site or or test site on subdirectory of live site. One user in the forum has reported that it also fails on xampp localhost

avatar SharkyKZ
SharkyKZ - comment - 28 Aug 2020

yes when it is not a valid path right?

No, it always fails on Windows because slash is used instead of DIRECTORY_SEPARATOR in the rule. Changing this alone is not enough because if value contains a slash (e.g. images/banners) this still fails on Windows even though Windows supports both slashes and backslashes.

avatar zero-24
zero-24 - comment - 28 Aug 2020

Ok will take a look into it.

avatar zero-24
zero-24 - comment - 28 Aug 2020

@SharkyKZ

Hm, no, this isn't right.

why this ins't right? That would be my solution too.

avatar zero-24
zero-24 - comment - 28 Aug 2020

I mean this PR: #30502

avatar zero-24
zero-24 - comment - 28 Aug 2020

we could also include a str_replace of / and \ with directory seperator to be sure. What do you think?

avatar Webdongle
Webdongle - comment - 28 Aug 2020

@SharkyKZ

No, it always fails on Windows because slash is used instead of DIRECTORY_SEPARATOR in the rule. Changing this alone is not enough because if value contains a slash (e.g. images/banners) this still fails on Windows even though Windows supports both slashes and backslashes.

But it worked upto J3.9.20, it's only emerged since J3.9.21. Spot the difference between the path in J3.9.2.0 and J2.9.21 and that is where the problem is. One of the PR's altered the way the path was written

avatar zero-24
zero-24 - comment - 28 Aug 2020

But it worked upto J3.9.20, it's only emerged since J3.9.21.

Yes with 3.9.21 we added the path validation rule.

avatar zero-24
zero-24 - comment - 28 Aug 2020

So we have to make sure that path validation rule works correctly

avatar SharkyKZ
SharkyKZ - comment - 28 Aug 2020

I'm just trying to understand what's the purpose of comparing original path with path put through JPath::clean(). Should we just return true if Path::check() passes without throwing exceptions?

avatar zero-24
zero-24 - comment - 28 Aug 2020

Should we just return true if Path::check() passes without throwing exceptions?

That work in that case too. The other check was there to make sure that the path is also passing Path::clean()

avatar zero-24
zero-24 - comment - 28 Aug 2020

@SniperSister @bembelimen can we get your inputs here? Whether we should do that additional check (that has than to be fixed that it passes on valid paths)

avatar SniperSister
SniperSister - comment - 29 Aug 2020

Should we just return true if Path::check() passes without throwing exceptions?

Sounds good to me

avatar zero-24
zero-24 - comment - 29 Aug 2020

@SharkyKZ do you want to do an PR for that or should I?

avatar Webdongle
Webdongle - comment - 29 Aug 2020

I can test a patch when one is created.

avatar SharkyKZ
SharkyKZ - comment - 29 Aug 2020

@zero-24 You can do.

avatar zero-24 zero-24 - close - 30 Aug 2020
avatar zero-24
zero-24 - comment - 30 Aug 2020

PR is: #30521 Thanks!

avatar zero-24 zero-24 - change - 30 Aug 2020
Status New Closed
Closed_Date 0000-00-00 00:00:00 2020-08-30 17:32:21
Closed_By zero-24
avatar Nubro01
Nubro01 - comment - 9 Sep 2020

I had this problem on one of my three websites. I noticed that on the site where the problem occured the configuration.php was set to readonly.
Resetting it did not seem to work. After checking security and comparing it with the other two, it stayed readonly unchecked.

I tried setting configuration.php on the 2nd site to readonly and that also now gave the same error, as did the 3th site, which I did not touch?

Rebooting ,clearing cash, nothing helped. Finnally found this issue, so it seems to happen only in 3.9.21
First site has "images" the other two "images" Checking the media on the first site shows the full system path on the bottom of the browser, the other two just show subfolder name, when present.


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/30500.

avatar Nubro01
Nubro01 - comment - 9 Sep 2020

typo, firsts site has "images" not "images"


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/30500.

avatar Nubro01
Nubro01 - comment - 9 Sep 2020

not a typo, backslash disappears after enter.


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/30500.

avatar zero-24
zero-24 - comment - 9 Sep 2020

Hi @Nubro01 yes this is an know issue that is going to be fixed in the next release. You can apply this change until the next release is out: https://patch-diff.githubusercontent.com/raw/joomla/joomla-cms/pull/30521.diff

Add a Comment

Login with GitHub to post a comment