I have tested this item ✅ successfully on 0a5e505

tested create and delete folder
tested create and delete files
tested create component override
tested create plugin override
tested create module override

no idea if the problem the original change was made for still exists or not

I have tested this item ✅ successfully on 0a5e505

tested create and delete folder
tested create and delete files
tested create component override
tested create plugin override
tested create module override

no idea if the problem the original change was made for still exists or not

no idea if the problem the original change was made for still exists or not

You meant the path traversal issue which the original PR tried to address? If so, it is still covered by this PR (and this PR also adds few more missing checks).

no idea if the problem the original change was made for still exists or not

You meant the path traversal issue which the original PR tried to address? If so, it is still covered by this PR (and this PR also adds few more missing checks).

yes - and i wanted to be clear i had not tested that part

I have tested this item ✅ successfully on 0a5e505

Tested with JBT

• Before PR with 5.4.8
  • Seen creating an override in components or plugins crashes, creating or deleting a folder crashes
• Installed PR with Joomla_5.4.9-dev+pr.48274-Development-Full_Package.zip
  • Creating an override in modules, components, plugins and templates is working
  • Creating and deleting an folder is working
  • Uploading an image file is working

    ---

    _{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48274.}

I have tested this item ✅ successfully on 0a5e505

Tested with JBT

• Before PR with 5.4.8
  • Seen creating an override in components or plugins crashes, creating or deleting a folder crashes
• Installed PR with Joomla_5.4.9-dev+pr.48274-Development-Full_Package.zip
  • Creating an override in modules, components, plugins and templates is working
  • Creating and deleting an folder is working
  • Uploading an image file is working

    ---

    _{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48274.}

RTC

RTC

I have tested this item ✅ successfully on 0a5e505

I've successfully tested the issue and the fix from this PR.

Without the PR applied:

Create folder ❌
Delete folder ❌
Create override - module ✅
Create override - component ❌
Create override - plugins ❌
Create override - layouts ❌
Upload png file ✅❌ (see remark below)

With the PR applied:

Create folder ✅
Delete folder ✅
Create override - module ✅
Create override - component ✅
Create override - plugins ✅
Create override - layouts ✅
Upload png file ✅❌ (see remark below)

Remark

The test for uploading a png file was successful when error reporting was set to system default or none in global configuration.

However, with error reporting = maximum, the image was uploaded and the image editor was shown with this PHP Warning:

Warning: Attempt to read property "filename" on null in /home/richard/lamp/public_html/joomla-cms-5.4-dev/administrator/components/com_templates/tmpl/template/default.php on line 66

Call Stack

#	Time	Memory	Function	Location
1	0.0000	356304	{main}( )	.../index.php:0
2	0.0001	357024	require_once( '/home/richard/lamp/public_html/joomla-cms-5.4-dev/administrator/includes/app.php )	.../index.php:32
3	0.0026	507520	Joomla\CMS\Application\CMSApplication->execute( )	.../app.php:58
4	0.0030	642096	Joomla\CMS\Application\AdministratorApplication->doExecute( )	.../CMSApplication.php:304
5	0.0175	1656040	Joomla\CMS\Application\AdministratorApplication->dispatch( $component = ??? )	.../AdministratorApplication.php:206
6	0.0205	1780048	Joomla\CMS\Component\ComponentHelper::renderComponent( $option = 'com_templates', $params = ??? )	.../AdministratorApplication.php:150
7	0.0209	1832592	Joomla\CMS\Dispatcher\ComponentDispatcher->dispatch( )	.../ComponentHelper.php:361
8	0.0210	1836080	Joomla\CMS\MVC\Controller\BaseController->execute( $task = 'display' )	.../ComponentDispatcher.php:143
9	0.0210	1836080	Joomla\Component\Templates\Administrator\Controller\DisplayController->display( $cachable = ???, $urlparams = ??? )	.../BaseController.php:730
10	0.0210	1836080	Joomla\CMS\MVC\Controller\BaseController->display( $cachable = ???, $urlparams = ??? )	.../DisplayController.php:68
11	0.0213	1844680	Joomla\Component\Templates\Administrator\View\Template\HtmlView->display( $tpl = ??? )	.../BaseController.php:697
12	0.0377	2042504	Joomla\CMS\MVC\View\HtmlView->display( $tpl = NULL )	.../HtmlView.php:218
13	0.0378	2042552	Joomla\CMS\MVC\View\HtmlView->loadTemplate( $tpl = NULL )	.../HtmlView.php:204
14	0.0379	2064256	include( '/home/richard/lamp/public_html/joomla-cms-5.4-dev/administrator/components/com_templates/tmpl/template/default.php )	.../HtmlView.php:419

This happens without this PR as well as with this PR applied.

It seems to depend on your environment if you see this error in backend like I do, or if this error is only logged in the PHP error file like it was observed by @muhme , as far as I remember, when testing another PR.

@joomdonation Do you think this is somehow related to what this PR here touches, and you can fix that with this PR here, too? Or is that something completely different which should be fixed separately with another PR?

I have tested this item ✅ successfully on 0a5e505

I've successfully tested the issue and the fix from this PR.

Without the PR applied:

Create folder ❌
Delete folder ❌
Create override - module ✅
Create override - component ❌
Create override - plugins ❌
Create override - layouts ❌
Upload png file ✅❌ (see remark below)

With the PR applied:

Create folder ✅
Delete folder ✅
Create override - module ✅
Create override - component ✅
Create override - plugins ✅
Create override - layouts ✅
Upload png file ✅❌ (see remark below)

Remark

The test for uploading a png file was successful when error reporting was set to system default or none in global configuration.

However, with error reporting = maximum, the image was uploaded and the image editor was shown with this PHP Warning:

Warning: Attempt to read property "filename" on null in /home/richard/lamp/public_html/joomla-cms-5.4-dev/administrator/components/com_templates/tmpl/template/default.php on line 66

Call Stack

#	Time	Memory	Function	Location
1	0.0000	356304	{main}( )	.../index.php:0
2	0.0001	357024	require_once( '/home/richard/lamp/public_html/joomla-cms-5.4-dev/administrator/includes/app.php )	.../index.php:32
3	0.0026	507520	Joomla\CMS\Application\CMSApplication->execute( )	.../app.php:58
4	0.0030	642096	Joomla\CMS\Application\AdministratorApplication->doExecute( )	.../CMSApplication.php:304
5	0.0175	1656040	Joomla\CMS\Application\AdministratorApplication->dispatch( $component = ??? )	.../AdministratorApplication.php:206
6	0.0205	1780048	Joomla\CMS\Component\ComponentHelper::renderComponent( $option = 'com_templates', $params = ??? )	.../AdministratorApplication.php:150
7	0.0209	1832592	Joomla\CMS\Dispatcher\ComponentDispatcher->dispatch( )	.../ComponentHelper.php:361
8	0.0210	1836080	Joomla\CMS\MVC\Controller\BaseController->execute( $task = 'display' )	.../ComponentDispatcher.php:143
9	0.0210	1836080	Joomla\Component\Templates\Administrator\Controller\DisplayController->display( $cachable = ???, $urlparams = ??? )	.../BaseController.php:730
10	0.0210	1836080	Joomla\CMS\MVC\Controller\BaseController->display( $cachable = ???, $urlparams = ??? )	.../DisplayController.php:68
11	0.0213	1844680	Joomla\Component\Templates\Administrator\View\Template\HtmlView->display( $tpl = ??? )	.../BaseController.php:697
12	0.0377	2042504	Joomla\CMS\MVC\View\HtmlView->display( $tpl = NULL )	.../HtmlView.php:218
13	0.0378	2042552	Joomla\CMS\MVC\View\HtmlView->loadTemplate( $tpl = NULL )	.../HtmlView.php:204
14	0.0379	2064256	include( '/home/richard/lamp/public_html/joomla-cms-5.4-dev/administrator/components/com_templates/tmpl/template/default.php )	.../HtmlView.php:419

This happens without this PR as well as with this PR applied.

It seems to depend on your environment if you see this error in backend like I do, or if this error is only logged in the PHP error file like it was observed by @muhme , as far as I remember, when testing another PR.

@joomdonation Do you think this is somehow related to what this PR here touches, and you can fix that with this PR here, too? Or is that something completely different which should be fixed separately with another PR?

I can confirm seeing that error in my logs when uploading a png flle

I can confirm seeing that error in my logs when uploading a png flle without this PR

@richard67 That warning is not related to the change in this PR and it also not something related to upload. This happens when we access to a file like images, font, archive files from template manager

Fixing this is easy. We basically need to wrap this line of code https://github.com/joomla/joomla-cms/blob/5.4-dev/administrator/components/com_templates/tmpl/template/default.php#L66 inside an if block

<?php if ($this->type === 'file') : ?>
	<p class="lead path hidden"><?php echo $this->escape($this->source->filename); ?></p>
<?php endif; ?>

I can make a separate PR for that, but it will just a blind fix because do not understand the purpose of that code (render absolute path of the file but hidden - maybe for accessibility, I do not know)

@richard67 That warning is not related to the change in this PR and it also not something related to upload. This happens when we access to a file like images, font, archive files from template manager

@joomdonation Thanks for checking. I can confirm it happens whenever you click e.g. an image in the template manager.

I can make a separate PR for that, but it will just a blind fix because do not understand the purpose of that code (render absolute path of the file but hidden - maybe for accessibility, I do not know)

That would be appreciated.

Thanks @joomdonation for this PR, @brianteeman and @muhme for testing, and @SniperSister for review.

That would be appreciated.

@richard67 PR made #48280