Please test PR #30502.

@joomla/security Can you take a look at this? What's the logic in checking that path is equal to path put through JPath::clean()?

It is intended to not be out of the root folder for example. What from the path did clean filter that causes the issue?

This line fails because JPath::check() runs path through JPath::clean() and then it's compared to original non-cleaned path:

So any slash/backslash or duplicate slash discrepancies fail here.

So any slash/backslash or duplicate slash discrepancies fail here.

yes when it is not a valid path right?

It worked before the update. Can you compare how it was before and after the update then fix it?

It worked before the update. Can you compare how it was before and after the update then fix it?

can you show me the value for that field that you use and that cause issues for you?

Vhange value of Maximum Size (in MB) and save or just save. Only fails on wamp localhost not live site or or test site on subdirectory of live site. One user in the forum has reported that it also fails on xampp localhost

yes when it is not a valid path right?

No, it always fails on Windows because slash is used instead of DIRECTORY_SEPARATOR in the rule. Changing this alone is not enough because if value contains a slash (e.g. images/banners) this still fails on Windows even though Windows supports both slashes and backslashes.

Ok will take a look into it.

@SharkyKZ

Hm, no, this isn't right.

why this ins't right? That would be my solution too.

I mean this PR: #30502

we could also include a str_replace of / and \ with directory seperator to be sure. What do you think?

@SharkyKZ

No, it always fails on Windows because slash is used instead of DIRECTORY_SEPARATOR in the rule. Changing this alone is not enough because if value contains a slash (e.g. images/banners) this still fails on Windows even though Windows supports both slashes and backslashes.

But it worked upto J3.9.20, it's only emerged since J3.9.21. Spot the difference between the path in J3.9.2.0 and J2.9.21 and that is where the problem is. One of the PR's altered the way the path was written

But it worked upto J3.9.20, it's only emerged since J3.9.21.

Yes with 3.9.21 we added the path validation rule.

So we have to make sure that path validation rule works correctly

I'm just trying to understand what's the purpose of comparing original path with path put through JPath::clean(). Should we just return true if Path::check() passes without throwing exceptions?

Should we just return true if Path::check() passes without throwing exceptions?

That work in that case too. The other check was there to make sure that the path is also passing Path::clean()

@SniperSister @bembelimen can we get your inputs here? Whether we should do that additional check (that has than to be fixed that it passes on valid paths)

Should we just return true if Path::check() passes without throwing exceptions?

Sounds good to me

@SharkyKZ do you want to do an PR for that or should I?

I can test a patch when one is created.

@zero-24 You can do.

PR is: #30521 Thanks!

I had this problem on one of my three websites. I noticed that on the site where the problem occured the configuration.php was set to readonly.
Resetting it did not seem to work. After checking security and comparing it with the other two, it stayed readonly unchecked.

I tried setting configuration.php on the 2nd site to readonly and that also now gave the same error, as did the 3th site, which I did not touch?

Rebooting ,clearing cash, nothing helped. Finnally found this issue, so it seems to happen only in 3.9.21
First site has "images" the other two "images" Checking the media on the first site shows the full system path on the bottom of the browser, the other two just show subfolder name, when present.

typo, firsts site has "images" not "images"

not a typo, backslash disappears after enter.

Hi @Nubro01 yes this is an know issue that is going to be fixed in the next release. You can apply this change until the next release is out: https://patch-diff.githubusercontent.com/raw/joomla/joomla-cms/pull/30521.diff