[#48247] - [5.4] revert invalid path check change - #48245
- Fixed in Code Base
- 15 Aug 2026
- Medium
- Build: 5.4-dev
- # 48247
- Diff
- SniperSister:5.4-template-path-traversal-fix
User tests: Successful: Unsuccessful:
Summary of Changes
While fixing #48171 a Path::clean was converted to Path::check that should have not been converted, causing error messages when uploading files in the template manager.
Equivalent PR for 6.1-dev see #48245 .
They are both the same, so you can mark your test result in both PRs when you have tested one of them.
The separate PRs just save the 6.1 release managers an upmerge before the upcoming release on Tuesday.
Testing Instructions
- Try upload a file in the template manager
Actual result BEFORE applying this Pull Request
- error message about "Snooping out of bounds", file being uploaded anyways
Expected result AFTER applying this Pull Request
- error message gone
Link to documentations
Please select:
-
Documentation link for guide.joomla.org:
-
No documentation changes for guide.joomla.org needed
-
Pull Request link for manual.joomla.org:
-
No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Administration com_templates |
I have tested this item ✅ successfully on f4c0ae6
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48247.
I have tested this item ✅ successfully on f4c0ae6
* Tested with JBT
- Seen error before PR
- Applied PR with Patch Tester
- File upload in template manager is working again
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48247.
- File upload in template manager is working again
I have tested this item ✅ successfully on f4c0ae6
* Tested with JBT
- Seen error before PR
- Applied PR with Patch Tester
- File upload in template manager is working again
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48247.
- File upload in template manager is working again
I have tested this item ✅ successfully on f4c0ae6
* Tested with JBT
- Seen error before PR
- Applied PR with Patch Tester
- File upload in template manager is working again
php.log contains the following warning:
[15-Aug-2026 12:35:49 UTC] PHP Warning: Attempt to read property "filename" on null in /var/www/html/administrator/components/com_templates/tmpl/template/default.php on line 66
<hr /><sub>This comment was created with the <a href="https://github.com/joomla/jissues">J!Tracker Application</a> at <a href="https://issues.joomla.org/tracker/joomla-cms/48247">issues.joomla.org/tracker/joomla-cms/48247</a>.</sub>
I have tested this item ✅ successfully on f4c0ae6
* Tested with JBT
- Seen error before PR
- Applied PR with Patch Tester
- File upload in template manager is working again
php.log contains the following warning:
[15-Aug-2026 12:35:49 UTC] PHP Warning: Attempt to read property "filename" on null in /var/www/html/administrator/components/com_templates/tmpl/template/default.php on line 66
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48247.
Additional information to me above test result:
When I have PHP Error Reporting set to Maximum in global configuration, the file upload works, but I get:
Warning: Attempt to read property "filename" on null in /home/richard/lamp/public_html/joomla-cms-5.4-dev/administrator/components/com_templates/tmpl/template/default.php on line 66
This does of course not happen without this PR as that will run into the exception from Path:check before that happens.
But this means the error is not really caused by this PR.
That's why I have submitted a successful test.
But if that can be fixed with this PR, too, I would be happy to test again.
Ping @SniperSister .
I've just verified that the PHP warning mentioned in my comment and @muhme 's test result is an old issue which exists also on a clean 5.4.7 installation, and the later PR #48171 has just masked it with the wrong "snooping out of bounds", which is fixed by this PR here.
So this PR here is ok, and the PHP warning can (and of course should) be fixed later.
| Labels |
Added:
PR-5.4-dev
|
||
| Status | Pending | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2026-08-15 14:29:17 |
| Closed_By | ⇒ | richard67 |
Thanks @SniperSister for this PR, and @muhme for testing.
I have tested this item ✅ successfully on f4c0ae6
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48247.