?
avatar berlanda
berlanda
19 Nov 2015

I tried to upload a pdf file using the media manager and I did not succeed. I sent the file and I did not receive any warning. The file simply do not upload. I noticed that the error depends on the pdf file uploaded, and it occurs due to the method isSafeFile() (class JFilterInput - libraries/joomla/filter/input.php), called within the method get() of the class JInputFiles (libraries/joomla/input/files.php, line 83).

The task upload(), from the media manager backend controller file.php, calls the method JInputFiles::get() through an object on the line 45 ($this->input->files->get).

Why it occurs? It occurs due to the forbidden extensions scan inside file contents, within the JFilterInput::isSafeFile(), from the line 459. In my case, when I saw the variable $data output (declared on line 467) from my pdf file, I found the string ".py" inside the pdf file code, one of the extensions verified by default, inside file contents. Important: the string was not inside the pdf file text.

I understood the importance of the method JFilterInput::isSafeFile(), but the search of simple extensions inside file content, being confused with the pdf file code, can cause problems that most users will not identify the reason.

avatar berlanda berlanda - open - 19 Nov 2015
avatar berlanda berlanda - change - 19 Nov 2015
Title
Some pdf files are not uploaded through the media manager
3.4.5 Some pdf files are not uploaded through the media manager
avatar ggppdk
ggppdk - comment - 21 Nov 2015

Yes there are cases that this will give false possitives, maybe there should be an option to disable check of extensions inside the file's contents ?

Besides Joomla Media manager, many 3rd party extensions i have checked out, are disabling the check.

Another reason for disabling the check of course is because you may really want to allow archives that contain programming code, but this last comment is not relevant to the media manager

avatar bertmert
bertmert - comment - 21 Nov 2015

Maybe this one is related: #8453

avatar zero-24 zero-24 - change - 25 Nov 2015
Category Media Manager
avatar zero-24 zero-24 - change - 25 Nov 2015
Labels Added: ?
avatar brianteeman brianteeman - change - 10 Mar 2016
Status New Duplicate Report
Closed_Date 0000-00-00 00:00:00 2016-03-10 15:45:26
Closed_By brianteeman
avatar brianteeman brianteeman - close - 10 Mar 2016
avatar brianteeman brianteeman - close - 10 Mar 2016
avatar brianteeman
brianteeman - comment - 10 Mar 2016

I am closing this as a duplicate of #8453


This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/8493.

Add a Comment

Login with GitHub to post a comment