When file uploads are optional, isSafeFile() still tries to check files that haven't been uploaded.
This is more obvious when using PHP 8 since fopen($path) will throw an error if $path is empty.
The only reason the below steps are needed is to easily illustrate the issue since I couldn't find a single place in Joomla! that has optional uploads.
administrator/components/com_media/views/tmpl/default.php
<input required type="file" id="upload-file" name="Filedata[]" multiple />
<input type="file" id="upload-file" name="Filedata[]" multiple />
Content > Media
Upload
on the toolbarStart Upload
Since no upload takes place, the page should refresh with an enqueued message.
Error
An error has occurred.
0 Path cannot be empty
JPATH_ROOT\libraries\src\Filter\InputFilter.php:630
PHP 8.0.1
Error comes from this line in libraries\src\Filter\InputFilter.php
:
$fp = @fopen($tempName, 'r');`
The $_FILES
array is populated, but tmp_name
will be an empty string and error
will be set to 4 which is UPLOAD_ERR_NO_FILE
. The logic in isSafeFile()
will still attempt to fopen()
this empty string which leads to an error in PHP 8. Easiest fix would be:
$fp = strlen($tempName) ? @fopen($tempName, 'r') : false;
A more elaborate fix would be to also check the error
segment of the $_FILES
array.
Labels |
Added:
?
|
Labels |
Added:
?
|
Labels |
Added:
?
?
Removed: ? |
Status | New | ⇒ | Closed |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2021-02-10 09:20:05 |
Closed_By | ⇒ | richard67 | |
Labels |
Added:
?
Removed: ? |
Status | Closed | ⇒ | New |
Closed_Date | 2021-02-10 09:20:05 | ⇒ | |
Closed_By | richard67 | ⇒ | |
Labels |
Added:
?
Removed: ? |
Status | New | ⇒ | Closed |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2021-02-10 12:09:54 |
Closed_By | ⇒ | richard67 |
Closing as having a pull request. Please test #32372 . Thanks in advance.