I tried to upload a pdf file using the media manager and I did not succeed. I sent the file and I did not receive any warning. The file simply do not upload. I noticed that the error depends on the pdf file uploaded, and it occurs due to the method isSafeFile() (class JFilterInput - libraries/joomla/filter/input.php), called within the method get() of the class JInputFiles (libraries/joomla/input/files.php, line 83).
The task upload(), from the media manager backend controller file.php, calls the method JInputFiles::get() through an object on the line 45 ($this->input->files->get).
Why it occurs? It occurs due to the forbidden extensions scan inside file contents, within the JFilterInput::isSafeFile(), from the line 459. In my case, when I saw the variable $data output (declared on line 467) from my pdf file, I found the string ".py" inside the pdf file code, one of the extensions verified by default, inside file contents. Important: the string was not inside the pdf file text.
I understood the importance of the method JFilterInput::isSafeFile(), but the search of simple extensions inside file content, being confused with the pdf file code, can cause problems that most users will not identify the reason.
Title |
|
Category | ⇒ | Media Manager |
Labels |
Added:
?
|
Status | New | ⇒ | Duplicate Report |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2016-03-10 15:45:26 |
Closed_By | ⇒ | brianteeman |
I am closing this as a duplicate of #8453
Yes there are cases that this will give false possitives, maybe there should be an option to disable check of extensions inside the file's contents ?
Besides Joomla Media manager, many 3rd party extensions i have checked out, are disabling the check.
Another reason for disabling the check of course is because you may really want to allow archives that contain programming code, but this last comment is not relevant to the media manager