› ›
CRITICAL SECURITY VERSION UPDATE:
https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.13

Uploaded file ends up with only the extension, i.e. ".pdf"

marcinkonysmarcinkonys
edited September 2014 in Modules
Hello everyone,

having a little issue with assets. I want to allow uploading PDF files via the CMS. However, when the file is uploaded, its original name is removed and only the extension remains, i.e. "abc.pdf" becomes ".pdf" on the server.

The main idea here is that the user should not have control over the file name. The file is uploaded with whatever name it has, then the record's ID is placed in the filename, i.e. a record with id 5 would have an associated file '5.pdf' upon saving.

edit: The weird thing is, the code works just as expected in my dev environment, but not on the server.

I want to sanitize the file names, sure, but I think using the "act_id" placeholder (1st snippet here) is pretty safe.

Comments

  • adminadmin
    edited September 2014
    A few questions:
    1. What version of FUEL are you running?
    2. Is act_id a value supplied in the $_POST when saving (it's a field in your table)? If not, have you tried using the on_before_post hook instead and injecting that value in the $_POST (e.g. $_POST['act_id'] = $act_id)

    The processing of file names exists in the fuel/modules/fuel/controllers/module.php file in the "_process_uploads" method.
  • marcinkonysmarcinkonys
    edited 5:54AM
    1. This site is on version 1.1.
    2. It's the primary key of the 'legal_acts' table.

    Thanks, I'll check out that method once more. Though I have a feeling I'll need to download all the files from the server and do a diff to check if I forgot to configure something properly :(
  • marcinkonysmarcinkonys
    edited September 2014
    Been trying to find the culprit to this error today.
    pathinfo($field_value, PATHINFO_FILENAME);
    This seems to return null. The server runs Linux I think. I haven't tested this on my Windows machine but it shouldn't return null, right?
  • adminadmin
    edited 5:54AM
    What version of PHP are you running?
  • marcinkonysmarcinkonys
    edited September 2014
    Oh God.

    It's 5.1.6.
    PATHINFO_FILENAME was added in 5.2.0.

    Looks like I'm gonna have to contact the sys admin.
    I wonder if there's some quick workaround to this.

    Edit:
    basename($field_value, "." . pathinfo($field_value, PATHINFO_EXTENSION)

    Will have to do for now.
    Thanks for the help :)
  • marcinkonysmarcinkonys
    edited 5:54AM
    By the way, your guide says that PHP v5.1.6+ is required. This should probably be fixed in the upcoming release (or the requirements page updated) as I guess I'm not the only one who's got to deal with an ancient server setup!
  • adminadmin
    edited 5:54AM
    Yeah... I noticed that yesterday after reviewing your issue and have that updated in the develop branch for the next release. Thanks.
  • lokeguptalokegupta
    edited 5:54AM
    Hi,

    I saw people struggling for uploading pdf files with fuel cms even with codeignitor only. Here is the solution - few version of mozilla sends $_FILES['type'] as 'pdf/download' and this is the main culprit.

    Solution : Change in appliction/config/mime.php

    'pdf' => array('application/pdf', 'application/x-pdf', 'application/x-download','application/download', 'binary/octet-stream', 'application/unknown', 'application/force-download'),

    Enjoy....
Sign In or Register to comment.