Joomla! Issue Tracker - CMS

Download
Launch
Feeling Lucky

[#48080] - [5.4] Update joomla/filesystem from 3.2.0 to 3.3.0 and partly backport PR 48038 from 6.1-dev

RTC Composer Dependency Changed PR-5.4-dev Pending

User tests: Successful: Unsuccessful:

avatar richard67
richard67
11 Jul 2026

Pull Request resolves # .

  • I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

This pull request (PR) updates the composer dependency "joomla/filesystem" from version 3.2.0 to version 3.3.0 and makes the necessary changes in the CMS core to adapt to the changes from this update.

It is a security hardening which makes sure that the File::upload method of that dependency does not allow to upload unsafe file by default, which includes executable file like e.g. PHP files.

The dependency update made with this PR with the 3.x version of the framework is equivalent to the update from version 4.1.0 to version 4.2.0 made in the 6.1-dev branch for 6.1.2-rc2 with this commit: a19f745

The code adjustments are equal to those made in the 6.1-dev branch for 6.1.2-rc3 with PR #48038 for allowing the upload of executable files, e.g. PHP files, where that shall be allowed by design because only superusers can do it, with one exception:

The changes in the template manager (file administrator/components/com_templates/src/Model/TemplateModel.php) are not backported as that would require additional changes. See this comment below for details: #48080 (comment)

It seems that with the change of the input filter from CMS to framework in 6.x with the framework filter missing the check for unsafe files, the possibility to upload PHP files in the template manages was enabled more or less by the way but not by intention.

It needs to be clarified if that shall be back-ported to 5.4.

If so, I will make the necessary PR which will also contain the change mentioned above.

Additional remark: The reason why the mentioned update has been made with the 6.1.2 release but not with 5.4.8 is because it's more urgent in 6.1 where the Joomla\CMS\Filesystem\File class which already included the security checks was moved to the b/c plugin, so it is much more likely that extension developers have already moved to the Joomla\Filesystem\File class where that feature was missing before the update.

Testing Instructions

1. Review the dependency updates

Verify that the update made here is equivalent to the update in the 6.1-dev branch by checking the release notes and changes here:

2. Review the code adjustments

Verify that the code adjustments made in this PR here are equal to those made with PR #48038 , except of the "joomla/filesystem" version in the code comments and except of the change in file administrator/components/com_templates/src/Model/TemplateModel.php, and that there are no other places in a current 5.4-dev branch where the File::upload method of the Joomla\Filesystem\File class is used.

3. Test that nothing is broken

Attention: This PR cannot be applied with the Patchtester component. It needs to have a local development environment with composer and NPM there you have checked out this PR and run a composer installand an npm ci, or you have to use the patched package created by Drone for this PR.

Test that the following still works with this PR applied:

  • Installing or updating an extension by using "System" → "Install" → "Upload Package File" to upload an installable zip file which contains PHP files
  • Updating the CMS core using the "Upload & Update" method of the Joomla Update component (button at the bottom) and a previously downloaded update zip file, e.g. a recent 6.1 nightly build or 6.1.2 stable.
    Attention: This test has to be made on an installation where the "installation" folder has been removed.
    Otherwise, if that folder is still present, you will get a PHP error:
    PHP Warning: Attempt to read property "name" on null in administrator/components/com_joomlaupdate/src/Model/UpdateModel.php on line 2024
    This happens with an without this PR and has the reason that the update package does of course not update the "installation" folder so you have a 6.1.2 with an installation folder of a 5.4.8-dev after the update, a scenario which cannot happen in real life with stable versions where the "installation" folder is always removed.

Actual result BEFORE applying this Pull Request

  1. Not applicable
  2. Not applicable
  3. Works all.

Expected result AFTER applying this Pull Request

  1. The dependency update is equivalent to what has been made in 6.1-dev with commit a19f745 .
  2. The code adjustments are equal to what has been made in 6.1-dev with PR #48038 , except of the "joomla/filesystem" version in the code comments and except of the change in file administrator/components/com_templates/src/Model/TemplateModel.php.
    There are no other places in a current 5.4-dev branch where the File::upload method of the Joomla\Filesystem\File class is used.
  3. Still works all.

Link to documentations

Please select:

  • Documentation link for guide.joomla.org:

  • No documentation changes for guide.joomla.org needed

  • Pull Request link for manual.joomla.org:

  • No documentation changes for manual.joomla.org needed

avatar richard67 richard67 - open - 11 Jul 2026
avatar richard67 richard67 - change - 11 Jul 2026
Status New ⇒ Pending
avatar joomla-cms-bot joomla-cms-bot - change - 11 Jul 2026
Category ⇒ Administration com_installer com_joomlaupdate com_templates External Library Composer Change
avatar richard67 richard67 - change - 11 Jul 2026
The description was changed
avatar richard67 richard67 - edited - 11 Jul 2026
avatar richard67
richard67 - comment - 11 Jul 2026

@HLeithner @tecpromotion Could you review and if ok approve this PR. That would be great. Thanks in advance.

avatar muhme muhme - test_item - 15 Jul 2026 - Tested unsuccessfully
avatar muhme
muhme - comment - 15 Jul 2026

I have tested this item 🔴 unsuccessfully on 0e8e928

✅ 1. Checked 3.3.0 source code changes are identical to 4.2.0:

git clone https://github.com/joomla-framework/filesystem.git
cd filesystem
git diff 3.2.0 3.3.0 > /tmp/32-33.patch
git diff 4.1.0 4.2.0 > /tmp/41-42.patch
diff /tmp/32-33.patch /tmp/41-42.patch

✅ 2. Compared https://github.com/joomla/joomla-cms/pull/48038/changes with https://github.com/joomla/joomla-cms/pull/48080/changes for the tree PHP files

  • Checked only these three modified places are using File::upload:
    • find . -name \*.php | xargs grep -n 'File::upload'
  1. Tested with JBT, applied PR with gh pr checkout 48080 && composer i
  • ✅ Command composer info joomla/filesystem shows version 3.3.0
  • ✅ File libraries/vendor/joomla/filesystem/src/File.php contains the changes
  • ✅ Installed module zitat-service.de via 'Upload Package File', configured the module and see it is working
  • ❌ Uploading PHP file fails with two red errors 'No file was found.' and 'Failed to upload file.'
avatar muhme
muhme - comment - 15 Jul 2026

I have tested this item 🔴 unsuccessfully on 0e8e928

✅ 1. Checked 3.3.0 source code changes are identical to 4.2.0:

git clone https://github.com/joomla-framework/filesystem.git
cd filesystem
git diff 3.2.0 3.3.0 > /tmp/32-33.patch
git diff 4.1.0 4.2.0 > /tmp/41-42.patch
diff /tmp/32-33.patch /tmp/41-42.patch

✅ 2. Compared https://github.com/joomla/joomla-cms/pull/48038/changes with https://github.com/joomla/joomla-cms/pull/48080/changes for the tree PHP files

  • Checked only these three modified places are using File::upload:
    • find . -name \*.php | xargs grep -n 'File::upload'
  1. Tested with JBT, applied PR with gh pr checkout 48080 && composer i
  • ✅ Command composer info joomla/filesystem shows version 3.3.0
  • ✅ File libraries/vendor/joomla/filesystem/src/File.php contains the changes
  • ✅ Installed module zitat-service.de via 'Upload Package File', configured the module and see it is working
  • ❌ Uploading PHP file fails with two red errors 'No file was found.' and 'Failed to upload file.'
avatar richard67
richard67 - comment - 15 Jul 2026

@muhme As the failed test fails without and with this PR, so this PR doesn't change anything on it, I might just have to change my testing instructions to something like "works like before".

Currently I haven't found the reason why uploading PHP files in the template manager works in 6.1 but doesn't work in 5.4.

@dgrammatiko Maybe you have an idea if there was a change for that in 6.0 or 6.1?

avatar joomdonation
joomdonation - comment - 16 Jul 2026

Currently I haven't found the reason why uploading PHP files in the template manager works in 6.1 but doesn't work in 5.4.

@richard67 You need to change this line https://github.com/joomla/joomla-cms/blob/5.4-dev/administrator/components/com_templates/src/Controller/TemplateController.php#L519 to

$upload = $this->input->files->get('files', null, 'raw');

The reason it works for Joomla 6 but not Joomla 5 is because on Joomla 5, we use CMS Input and input->files->get will reject the unsafe files (PHP file in this case) unless we use raw filter in get method. See https://github.com/joomla/joomla-cms/blob/5.4-dev/libraries/src/Input/Files.php#L95

On Joomla 6, we use framework Input and it does not have this security feature, mean the unsafe files won't be rejected when calling input->files->get

avatar richard67
richard67 - comment - 16 Jul 2026

@joomdonation Thanks a lot. I will update my PR here after work to fix that.

avatar richard67
richard67 - comment - 16 Jul 2026

Maybe I should fix that with a separate PR?

avatar joomdonation
joomdonation - comment - 16 Jul 2026

Better have it included in this PR, otherwise the modification in TemplateModel to allow uploading un-safe files is useless.

avatar richard67 richard67 - change - 18 Jul 2026
Labels Added: Composer Dependency Changed PR-5.4-dev
avatar joomla-cms-bot joomla-cms-bot - change - 18 Jul 2026
Category Administration com_installer com_joomlaupdate com_templates External Library Composer Change ⇒ Administration com_installer com_joomlaupdate External Library Composer Change
avatar richard67 richard67 - change - 18 Jul 2026
Title
…
[5.4] Update joomla/filesystem from 3.2.0 to 3.3.0 and backport PR 48038 from 6.1-dev
[5.4] Update joomla/filesystem from 3.2.0 to 3.3.0 and partly backport PR 48038 from 6.1-dev
avatar richard67 richard67 - edited - 18 Jul 2026
avatar richard67 richard67 - change - 18 Jul 2026
The description was changed
avatar richard67 richard67 - edited - 18 Jul 2026
avatar richard67
richard67 - comment - 18 Jul 2026

Better have it included in this PR, otherwise the modification in TemplateModel to allow uploading un-safe files is useless.

I have decided against this and have reverted the change in the administrator/components/com_templates/src/Model/TemplateModel.php.

To me it seems that the possibility to upload PHP files in the template manager just slipped through when the switch from the CMS to the framework filter was made.

It needs a separate decision if that shall be made possible in 5.4, too.

If that will be done, I can make a new PR.

I will put it on the table in the relevant teams.

avatar richard67
richard67 - comment - 18 Jul 2026

@HLeithner @tecpromotion Could you review again with the latest change? See the updated PR description for details That would be great. Thanks in advance.

@muhme Could you test again? The change in the template manager was reverted, so it needs only the core update and extension update to be tested.

avatar joomdonation
joomdonation - comment - 18 Jul 2026

To me it seems that the possibility to upload PHP files in the template manager just slipped through when the switch from the CMS to the framework filter was made.

Just for information, It was decided to allow uploading PHP files through templates manager, see the description from PR for 6.1 #48038. @SniperSister agreed/advised to do so

avatar richard67
richard67 - comment - 18 Jul 2026

To me it seems that the possibility to upload PHP files in the template manager just slipped through when the switch from the CMS to the framework filter was made.

Just for information, It was decided to allow uploading PHP files through templates manager, see the description from PR for 6.1 #48038. @SniperSister agreed/advised to do so

@joomdonation Yes, I know. But there it was not a change on functionality, it had worked there also before that PR.

Here on 5.4 it would be a change of functionality coming with a minor version. This is something which I don't want to decide alone.

avatar richard67
richard67 - comment - 18 Jul 2026

To me it seems that the possibility to upload PHP files in the template manager just slipped through when the switch from the CMS to the framework filter was made.

Just for information, It was decided to allow uploading PHP files through templates manager, see the description from PR for 6.1 #48038. @SniperSister agreed/advised to do so

@joomdonation Yes, I know. But there it was not a change on functionality, it had worked there also before that PR.

Here on 5.4 it would be a change of functionality coming with a patch version. This is something which I don't want to decide alone.

avatar muhme muhme - test_item - 18 Jul 2026 - Tested successfully
avatar muhme
muhme - comment - 18 Jul 2026

I have tested this item ✅ successfully on 6b7def4


✅ 1. Checked 3.3.0 source code changes are identical to 4.2.0:

git clone https://github.com/joomla-framework/filesystem.git
cd filesystem
git diff 3.2.0 3.3.0 > /tmp/32-33.patch
git diff 4.1.0 4.2.0 > /tmp/41-42.patch
diff /tmp/32-33.patch /tmp/41-42.patch

✅ 2. Review the code adjustments

  1. Tested with JBT, applied PR with gh pr checkout 48080 && composer i
  • ✅ Command composer info joomla/filesystem shows version 3.3.0
  • ✅ File libraries/vendor/joomla/filesystem/src/File.php contains the changes
  • ✅ Installed module zitat-service.de via 'Upload Package File', configured the module and see it is working
  • ✅ Updated to 6.1.2 by deleting installation folder and 'Upload and Update' with Joomla_6.1.2-Stable-Update_Package.zip
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48080.
avatar muhme
muhme - comment - 18 Jul 2026

I have tested this item ✅ successfully on 6b7def4


✅ 1. Checked 3.3.0 source code changes are identical to 4.2.0:

git clone https://github.com/joomla-framework/filesystem.git
cd filesystem
git diff 3.2.0 3.3.0 > /tmp/32-33.patch
git diff 4.1.0 4.2.0 > /tmp/41-42.patch
diff /tmp/32-33.patch /tmp/41-42.patch

✅ 2. Review the code adjustments

  1. Tested with JBT, applied PR with gh pr checkout 48080 && composer i
  • ✅ Command composer info joomla/filesystem shows version 3.3.0
  • ✅ File libraries/vendor/joomla/filesystem/src/File.php contains the changes
  • ✅ Installed module zitat-service.de via 'Upload Package File', configured the module and see it is working
  • ✅ Updated to 6.1.2 by deleting installation folder and 'Upload and Update' with Joomla_6.1.2-Stable-Update_Package.zip
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48080.
avatar muhme
muhme - comment - 18 Jul 2026

I have tested this item ✅ successfully on 6b7def4


✅ 1. Checked 3.3.0 source code changes are identical to 4.2.0:

git clone https://github.com/joomla-framework/filesystem.git
cd filesystem
git diff 3.2.0 3.3.0 > /tmp/32-33.patch
git diff 4.1.0 4.2.0 > /tmp/41-42.patch
diff /tmp/32-33.patch /tmp/41-42.patch
  1. Review the code adjustments
  1. Tested with JBT, applied PR with gh pr checkout 48080 && composer i
  • ✅ Command composer info joomla/filesystem shows version 3.3.0
  • ✅ File libraries/vendor/joomla/filesystem/src/File.php contains the changes
  • ✅ Installed module zitat-service.de via 'Upload Package File', configured the module and see it is working
  • ✅ Updated to 6.1.2 by deleting installation folder and 'Upload and Update' with Joomla_6.1.2-Stable-Update_Package.zip
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48080.
avatar richard67 richard67 - alter_testresult - 5 Aug 2026 - muhme: Tested successfully
avatar tecpromotion tecpromotion - test_item - 6 Aug 2026 - Tested successfully
avatar tecpromotion
tecpromotion - comment - 6 Aug 2026

I have tested this item ✅ successfully on dbbc064

Thanks @richard67

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48080.

avatar tecpromotion
tecpromotion - comment - 6 Aug 2026

I have tested this item ✅ successfully on dbbc064

Thanks @richard67

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48080.

avatar richard67 richard67 - change - 6 Aug 2026
Status Pending ⇒ Ready to Commit
avatar richard67
richard67 - comment - 6 Aug 2026

RTC

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48080.

avatar richard67
richard67 - comment - 6 Aug 2026

RTC

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48080.

avatar muhme muhme - change - 8 Aug 2026
Labels Added: RTC
avatar muhme
muhme - comment - 8 Aug 2026

Final test before merge

✅ 1. Checked 3.3.0 source code changes are identical to 4.2.0:

git clone https://github.com/joomla-framework/filesystem.git
cd filesystem
git diff 3.2.0 3.3.0 > /tmp/32-33.patch
git diff 4.1.0 4.2.0 > /tmp/41-42.patch
diff /tmp/32-33.patch /tmp/41-42.patch

✅ 2. Compared https://github.com/joomla/joomla-cms/pull/48038/changes with https://github.com/joomla/joomla-cms/pull/48080/changes for the tree PHP files

  • Changes are identical, except the changes in the template manager (file administrator/components/com_templates/src/Model/TemplateModel.php) which are intentely not backported

✅ C3. Tested with JBT, applied PR with gh pr checkout 48080 && composer i

  • Command composer info joomla/filesystem shows version 3.3.0
  • File libraries/vendor/joomla/filesystem/src/File.php contains the changes
  • Checked only these two modified places and the one exception are using File::upload:
    • find . -name \*.php | xargs grep -n 'File::upload'
  • Installed module zitat-service.de via 'Upload Package File', configured the module and see it is working
  • Uploading PHP file fails with two red errors 'No file was found.' and 'Failed to upload file.' as with the same errors already in 5.4.7 (Please note, this works in 6.1, see PR comments)
  • Over-installed Joomla_5.4.8-dev+pr.48080-Development-Update_Package.zip with Upload & Update
avatar muhme muhme - change - 8 Aug 2026
Status Ready to Commit ⇒ Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 ⇒ 2026-08-08 12:31:05
Closed_By ⇒ muhme
avatar muhme muhme - close - 8 Aug 2026
avatar muhme muhme - merge - 8 Aug 2026
avatar muhme
muhme - comment - 8 Aug 2026

Thank you very much @richard67 for your contribution. Thank you @joomdonation for support. Thank you @HLeithner for review. Thank you @tecpromotion for testing and review.

avatar Pinkeltje
Pinkeltje - comment - 30 Aug 2026

This hardening breaks legitimate uploads i.e in Phoca Download (admin "multiple upload", fileupload.php:314). Filenames inside a zip are stored uncompressed in the zip directory, so any zip containing .php files (even a plain Joomla install package, or Phoca Download's own extension zip) now gets rejected with "File not uploaded for security reasons!" — even for a superuser upload.

Worked fine on 5.4.7, broke after this PR landed in 5.4.8. Phoca's upload function calls File::upload() without the "allow unsafe" flag, so it hits this. Might be worth a mention in the changelog/migration guide so extension devs know they now need to set that flag explicitly.

avatar Pinkeltje
Pinkeltje - comment - 30 Aug 2026

This hardening breaks legitimate uploads i.e in Phoca Download (admin "multiple upload", fileupload.php:314). Filenames inside a zip are stored uncompressed in the zip directory, so any zip containing .php files (even a plain Joomla install package, or Phoca Download's own extension zip) now gets rejected with "File not uploaded for security reasons!" — even for a superuser upload.

Worked fine on 5.4.7, broke after this PR landed in 5.4.8. Phoca's upload function calls File::upload() without the "allow unsafe" flag, so it hits this. Might be worth a mention in the changelog/migration guide so extension devs know they now need to set that flag explicitly.
Already reported to Phoca developer as well, but not sure if this breaks other extensions as well.

avatar richard67
richard67 - comment - 30 Aug 2026

Worked fine on 5.4.7, broke after this PR landed in 5.4.8.

In 6.x the relevant change - update of the joomla/filesystem dependency - has been made 1 release cycle earlier, so it was released with 6.1.2, and then this PR here backported that to 5.4. This just as additional information.

Add a Comment

Login with GitHub to post a comment