fileupload in modal box not working for some file extensions

[actionwave34F]

We have a document function and needs to upload a number of different types ( defined in media manager) using modal box. "txt" , "zip" and "php" extensions are not uploaded and no records are added in xxx_repeat_documents table.
Doing the same thing in page mode works fine. We can live with that doing things in page mode but it should work using modal box for the future.

 

[cheesegrits]

My first comment would be that you should never allow PHP files to be uploaded, you should always require those to be ZIP'ed.

However, ZIP files should upload, I'll give it a go ...

-- hugh

 

[cheesegrits]

Are you sure this is related to submitting from a modal?

As far as I can tell, it's a result of JFile::isSafeFile(), the built in J! file upload safety checker, now defaulting to being a lot more aggressive, so for example it no longer just won't allow PHP files, it won't allow files that contain PHP tags, or (afaict) ZIP files that contain PHP files, etc.

So I can get it to behave as you described in both modal and regular page mode, by attempting to upload either a PHP file, or a ZIP with PHP files, any file with <?php tags in it.

The only way to solve this is going to be to add a "Allow unsafe files" option to the upload element, which I'm looking at doing at the moment.

-- hugh

 

[cheesegrits]

OK, I've added a new "Disable Safety Check" option, which will allow you to upload things like ZIP's with PHP files in them, etc.

USE WITH CARE! The J! upload safety check prevents a number of malicious upload attacks, so make sure that your form is suitably access protected.

https://github.com/Fabrik/fabrik/commit/db2453b446e5162d97a1ba9d77b4a71ba73b2f3d

-- hugh

 

[actionwave34F]

Aha , that's explains things. And yes, it didn't work from a modal popup box , but the same thing in a normal page. The resulting data after using modal box and upload was "null" into file name field.

 

[cheesegrits]

Yup. I've also fixed that bug, which was ignoring a failed upload. So if you don't enable the new option, and J! barfs on isSafeFile(), we won't write the null row out any more.

I was just confused 'cos your OP said that it worked in a normal page, but I'm assuming you probably tested with a different file which didn't trigger the safety check.

So should all be fixed now.

-- hugh