Language Change PR-4.3-dev Pending

User tests: Successful: Unsuccessful:

avatar brianteeman
brianteeman
14 Aug 2022

It is currently possible to upload a file.min.css, file.min.js, file.asset.json

However it is not possible to rename or create a new file as we had a check to prevent having a . in the name

There really is no need for this restriction. It dates back 10 years to a security fix but it wasn't needed as the rest of the security fix is still valid.

NOTE: This does not add .min.css or .min.js or asset.json to the list of filetypes. They are still just css, js and json but now you can put a dot in the filename

image

image

avatar brianteeman brianteeman - open - 14 Aug 2022
avatar brianteeman brianteeman - change - 14 Aug 2022
Status New Pending
avatar joomla-cms-bot joomla-cms-bot - change - 14 Aug 2022
Category Administration com_templates Language & Strings
avatar N6REJ
N6REJ - comment - 14 Aug 2022

I have tested this item successfully on 1e62228


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.

avatar N6REJ N6REJ - test_item - 14 Aug 2022 - Tested successfully
avatar Kostelano
Kostelano - comment - 14 Aug 2022

I have tested this item successfully on 1e62228


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.

avatar Kostelano Kostelano - test_item - 14 Aug 2022 - Tested successfully
avatar richard67 richard67 - change - 14 Aug 2022
Status Pending Ready to Commit
Labels Added: Language Change ?
avatar richard67
richard67 - comment - 14 Aug 2022

RTC


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.

avatar richard67
richard67 - comment - 14 Aug 2022

@brianteeman Does this PR solve the 2 issues #38455 and #30908 so they can be closed?

avatar bembelimen
bembelimen - comment - 16 Aug 2022

Just from code review: we have to be careful to not allow: "...hello...bla.min"

avatar brianteeman
brianteeman - comment - 16 Aug 2022

@bembelimen I did wonder about that but I assumed (maybe incorrectly) that as we didnt allow the slash it would not be a problem?

avatar brianteeman
brianteeman - comment - 17 Aug 2022

please remove the RTC on this.

@bembelimen was correct and we need to prevent a .. in the filename. I was only thinking of security but actually it blows away the php if its allowed. - will update this PR later

avatar richard67 richard67 - change - 17 Aug 2022
Status Ready to Commit Pending
avatar richard67
richard67 - comment - 17 Aug 2022

Back to pending due to reason stated in previous comment.


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.

avatar brianteeman
brianteeman - comment - 18 Aug 2022

Please retest and confirm that you can now create, rename files with a dot in them AND that you cannot when there are two or more dots

avatar zero-24
zero-24 - comment - 18 Aug 2022

Whats with a "invisible space" IIRC thats not catched by strpos. Or some kind of none breaking change as well as some unicode char thats confusing the filename/filesystem? didnt we have a filter class where we could throw this file name against too?

avatar brianteeman
brianteeman - comment - 19 Aug 2022

@zero-24 The file is already going through a filter before this iirc. If not then its beyond the scope of this PR as it would be possible before this PR as well. please test those yourself.

avatar Kostelano
Kostelano - comment - 19 Aug 2022

I have tested this item successfully on fa2068e

Tested again. With one dot - the file was created, with two or more - an error.


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.

avatar Kostelano Kostelano - test_item - 19 Aug 2022 - Tested successfully
avatar jwaisner
jwaisner - comment - 19 Aug 2022

I have tested this item successfully on fa2068e


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.

avatar jwaisner jwaisner - change - 19 Aug 2022
Status Pending Ready to Commit
avatar jwaisner
jwaisner - comment - 19 Aug 2022

RTC


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.

avatar jwaisner jwaisner - test_item - 19 Aug 2022 - Tested successfully
avatar bembelimen
bembelimen - comment - 28 Aug 2022

"." should not be allowed at the beginning of the name (as then the file is hidden) and also not at the end of the name (to avoid again the ".." with the extension.

avatar brianteeman
brianteeman - comment - 28 Aug 2022

should not be allowed at the beginning of the name
Its not - either before or after this pr. In both cases the leading dot is stripped

also not at the end of the name
yeah thats a bug in the regex will need to fix thaat after the holiday

avatar brianteeman
brianteeman - comment - 28 Aug 2022

please remove rtc for now

avatar richard67 richard67 - change - 28 Aug 2022
Status Ready to Commit Pending
avatar richard67
richard67 - comment - 28 Aug 2022

Back to pending.


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.

60c2709 29 Aug 2022 avatar brianteeman regex
avatar brianteeman
brianteeman - comment - 29 Aug 2022

Sorry I must have got distracted. I had the correct regex already written but for some reason I didnt include it.

You can test the regex here https://rextester.com/RULEP70144

avatar Kostelano
Kostelano - comment - 30 Aug 2022

I have tested this item successfully on e291abb


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.

avatar Kostelano Kostelano - test_item - 30 Aug 2022 - Tested successfully
avatar viocassel
viocassel - comment - 2 Sep 2022

I have tested this item successfully on e291abb


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.

avatar viocassel viocassel - test_item - 2 Sep 2022 - Tested successfully
avatar N6REJ N6REJ - change - 2 Sep 2022
Status Pending Ready to Commit
avatar N6REJ
N6REJ - comment - 2 Sep 2022

RTC


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.

avatar N6REJ
N6REJ - comment - 2 Sep 2022

RTC


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.

avatar brianteeman brianteeman - change - 2 Sep 2022
Labels Added: ?
avatar fancyFranci
fancyFranci - comment - 15 Sep 2022

I would really like to merge it, but regex with this size are tricky and need more tests. I'm wondering where the underscore in the first regex went? But 4.3 has the time to test intensively, so I'm moving the PR.

avatar brianteeman
brianteeman - comment - 15 Sep 2022

There will be zero extra tests. Look at who has already tested it.

avatar obuisard
obuisard - comment - 17 Sep 2022

As @fancyFranci noticed, it does not allow underscore in the regexp anymore. A file name like joomla_78.min.css will fail.
Why are the regular expressions different in create/rename? Shouldn't they be identical?

avatar brianteeman brianteeman - change - 17 Sep 2022
Labels Added: PR-4.3-dev
Removed: ?
avatar bembelimen
bembelimen - comment - 27 Sep 2022

Sorry, don't want to be the party pooper again. So I tested it:

Before:

Edit/Create file:

  • _bla.scss => works
  • bla.min.css => does not work
  • text-file.php => works
  • .hui.txt => converted to "hui.txt" andsaved (should probably give an error)

After:

Create file:

  • _bla.scss => does not work
  • bla.min.css => works
  • text-file.php => does not work
  • .hui.txt => converted to "hui.txt"

Edit file:

  • _bla.scss => works
  • bla.min.css => does not work
  • text-file.php => works
  • .hui.txt => converted to "hui.txt" and saved

I also think I was wrong regaring the "." at the beginning, there is no test needed as the getCmd filter already removed the ".". So I think (?!.*\\..*\\..*) is not needed at the beginning?

avatar bembelimen bembelimen - change - 27 Sep 2022
Status Ready to Commit Pending
avatar bembelimen
bembelimen - comment - 27 Sep 2022

Back to pending


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38458.

avatar brianteeman
brianteeman - comment - 27 Sep 2022

Please make up your minds.

Closed

avatar brianteeman brianteeman - change - 27 Sep 2022
Status Pending Closed
Closed_Date 0000-00-00 00:00:00 2022-09-27 07:57:18
Closed_By brianteeman
Labels Removed: ?
avatar brianteeman brianteeman - close - 27 Sep 2022
avatar bembelimen
bembelimen - comment - 28 Sep 2022

My intention was not to block it :( just giving it a proper testing as I think it's a nice feature.

avatar obuisard
obuisard - comment - 28 Sep 2022

The difference in create and edit comes from the fact that they both use a different regular expression, therefore you get different results. Nothing major :-)

avatar obuisard
obuisard - comment - 26 Oct 2022

@brianteeman this is a good PR, it addresses issues encountered by users.
Would you mind re-opening it? Thank you.

avatar richard67
richard67 - comment - 27 Oct 2022

@obuisard There is PR #38987 .

avatar brianteeman
brianteeman - comment - 27 Oct 2022

what he said

avatar obuisard
obuisard - comment - 27 Oct 2022

Thank you and super :-) @brianteeman @richard67

Add a Comment

Login with GitHub to post a comment