? ? ?
avatar OctavianC
OctavianC
3 Feb 2021

Steps to reproduce the issue

When file uploads are optional, isSafeFile() still tries to check files that haven't been uploaded.
This is more obvious when using PHP 8 since fopen($path) will throw an error if $path is empty.
The only reason the below steps are needed is to easily illustrate the issue since I couldn't find a single place in Joomla! that has optional uploads.

  • Edit administrator/components/com_media/views/tmpl/default.php
  • Search for <input required type="file" id="upload-file" name="Filedata[]" multiple />
  • Remove the required attribute so that it reads <input type="file" id="upload-file" name="Filedata[]" multiple />
  • Additionally you can simply change the required attribute by using the Inspector in your browser
  • Go to Content > Media
  • Click on Upload on the toolbar
  • Don't select a file
  • Click on Start Upload

Expected result

Since no upload takes place, the page should refresh with an enqueued message.

Actual result

Error
An error has occurred.

0 Path cannot be empty
JPATH_ROOT\libraries\src\Filter\InputFilter.php:630 

System information (as much as possible)

PHP 8.0.1

Additional comments

Error comes from this line in libraries\src\Filter\InputFilter.php:

$fp = @fopen($tempName, 'r');`

The $_FILES array is populated, but tmp_name will be an empty string and error will be set to 4 which is UPLOAD_ERR_NO_FILE. The logic in isSafeFile() will still attempt to fopen() this empty string which leads to an error in PHP 8. Easiest fix would be:

$fp = strlen($tempName) ? @fopen($tempName, 'r') : false;

A more elaborate fix would be to also check the error segment of the $_FILES array.

avatar OctavianC OctavianC - open - 3 Feb 2021
avatar joomla-cms-bot joomla-cms-bot - change - 3 Feb 2021
Labels Added: ?
avatar joomla-cms-bot joomla-cms-bot - labeled - 3 Feb 2021
avatar chmst chmst - change - 3 Feb 2021
Labels Added: ?
avatar chmst chmst - labeled - 3 Feb 2021
avatar alikon alikon - change - 4 Feb 2021
Labels Added: ? ?
Removed: ?
avatar alikon alikon - labeled - 4 Feb 2021
avatar richard67 richard67 - change - 10 Feb 2021
Status New Closed
Closed_Date 0000-00-00 00:00:00 2021-02-10 09:20:05
Closed_By richard67
Labels Added: ?
Removed: ?
avatar richard67 richard67 - close - 10 Feb 2021
avatar richard67
richard67 - comment - 10 Feb 2021

Closing as having a pull request. Please test #32372 . Thanks in advance.

avatar richard67
richard67 - comment - 10 Feb 2021

Re-opening since this issue is for both 3.x and 4.0, but PR #32372 fixes it only for 4.0.

avatar richard67 richard67 - change - 10 Feb 2021
Status Closed New
Closed_Date 2021-02-10 09:20:05
Closed_By richard67
Labels Added: ?
Removed: ?
avatar richard67 richard67 - reopen - 10 Feb 2021
avatar richard67 richard67 - close - 10 Feb 2021
avatar richard67
richard67 - comment - 10 Feb 2021

Pull request for staging is #32374 , for 4.0-dev it's #32372 . Please test. Thanks in advance,

avatar richard67 richard67 - change - 10 Feb 2021
Status New Closed
Closed_Date 0000-00-00 00:00:00 2021-02-10 12:09:54
Closed_By richard67

Add a Comment

Login with GitHub to post a comment