[#8903] - JInputFiles get() silently discards unsafe files
- Closed
- 21 Apr 2017
- Medium
- Build: master
- # 8903
Steps to reproduce the issue
Enable zip extension in backend media manager.
- upload a zip containing an extension (considered unsafe by JFilterInput::isSafeFile)
- upload a zip containing a text file (considered safe)
Expected result
- first upload should show an error of some kind to the user
- second upload should succeed
Actual result
- the first upload fails, but there is no error to be seen...
- the uploads works, there is a success message
System information (as much as possible)
joomla 3.4.8
Additional comments
https://github.com/joomla/joomla-cms/blob/master/libraries/joomla/input/files.php#L87
This is the issue: returning default is ok if there was nothing uploaded, not when there was indeed an issue.
Either the results array should be returned with error key set (but the regular php errors don't match that case), or an exception should be raised.
The latter is probably better but i am not sure about backwards compatibility
Issue remains on Joomla! 3.7.0-staging.
I can confirm the problem on 3.7.0-stagin
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/8903.
joomla-cms-bot
- | Status | New | ⇒ | Confirmed |
| Status | Confirmed | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2017-04-21 21:22:04 |
| Closed_By | ⇒ | zero-24 |
Please test there.
the references pr doesn't fix the global issue, it only fixes it when using the com_media controller, but not the use of this code by 3rd party.
I don't see a way to do this without throwing an error which is IIRC not B/C and needs to be done in 4.0 Can you do a PR for that against the 4.0 repo and the the PR i have added?
@brianteeman
I would love to hear your suggestion on this because i think raising an exception would be a good thing to do.