Problem uploading PDF files (only some of them) in a ZIP using Media Manager Topic is solved

[zyltar]

Hello,

We just noticed on one of our customer's website that some ZIP archive containing PDF files were impossible to upload probably due to the file field filter, the error message being : You have tried to upload file(s) that are not safe.

I tried to determine which PDF files of these ZIP archives were triggering the issue and to upload them separately which worked perfectly meaning these files are identified as unsafe when in an archive but not on their own. Of course I can also upload a ZIP of the remaining PDF files which do not trigger the error.

Unfortunately I cannot submit the concerned files here as they belong to our customer and are confidential but I found another one on the web which is not confidential and triggers the same error when in a ZIP : https://framabook.org/docs/atelierdrupa ... _CC-By.pdf

This file is quite large but some of those our customer sent us are less than 1 Mo and still triggering the issue so it does not depend on the weight.

As for the context, we are of course running Joomla 3.9.22 and I added zip,ZIP to the legal extensions and application/zip to the legal MIME types in com_media configuration. I also mention that uploading the ZIP via JCE file manager (tested on another website which also shows the com_media issue) does not trigger any error.

Do you think I should submit that as a bug or do you have any idea on how it could be fixed ?


Thanks in advance for your help.

[toivo]

Issue confirmed in 3.9.22. Recommend to use JCE or FTP for uploading archives because .zip files can contain combinations of characters like .py, which are forbidden as extensions of executable files.

The behaviour was reported last year as [#26408] - [3.9] Mediamanager: uploading bigger zip archives / unsafe file Message.

The description of the issue from 2017 as False Positives in isSafeFile() #15563 summarises the root cause.

[zyltar]

Thanks a lot for the information.

If it's open since 2017 and has completely stop between september 2019 and september 2020, I guess that means it won't be fixed soon and we'll have to find a way to get around it as we are also encountering this issue in a custom component in which we use the file field.

Any idea of a hotfix we could implement ?

[toivo]

You need a workaround if PDF files have to be uploaded as compressed archives.

The situation will be the same in the forthcoming Joomla 4. Today's Joomla4 Beta6 development version displays an error message, "An error occurred", in Content - Media when a .zip archive of a PDF file is uploaded.

[zyltar]

Ok, good to know.

Thanks for your help and have a nice weekend.

[Per Yngve Berg]

This is better done in the Phoca Download Component.

https://extensions.joomla.org/extension/phoca-download/


The documents are no longer confidential when you upload them to a public web server for everyone on the Internet to download them. With Phoca Download you can secure them with Joomla Access Control. Place the files outside of the public_html to prevent direct file download.

[zyltar]

Thanks for your feedback.

I know Phoca Download but I encounter this problem with a custom component we run on one of our customer's website and which is not used only for uploading files meaning I could not replace it by a download component.

As for the files, I also upload them outside the root directory and have no problem for that part when I can get them. Unfortunately due to this joomla false positives on the filtering of the file field, I often get an empty value.

Anyway, I'll try to find a way to get around it.

[sozzled]

I am assuming that (because this topic is located in the Joomla! 3.x Bug Reporting forum category) we are discussing a defect in the J! CMS core and not "recommendations" (or advertisements) for third-party products that may, or may not, address the question.

If we are discussing a known defect with using .zip files containing miscellaneous content (including PDFs), it's worth pointing out that a change has been proposed—to be included with J! 3.9.23—that addresses this matter: see https://github.com/joomla/joomla-cms/pull/31246. Perhaps that helps?

If we are seeking recommendations for third-party products then, IMO, this is probably not the right forum category to be making those suggestions.

[zyltar]

Thanks for the feedback but the issue I am talking about concern the security check ran by Joomla when using file field to upload ZIP archive and I don't think the change you mention will fix it unfortunately.

Have a nice day.

[sozzled]

J! 3.9.23 has been released. Might be worth giving it a try.

[toivo]

No difference, as @zyltar expected.

[zyltar]

Sorry for the late answer. I confirm it's the same on 3.9.23.