Unable to upload files with version 6.1.5

[Astrid]

Unable to upload files from backend.Changed options for max upload size for backend to test, but not working either.
[img]https://joomlanl.nl/images/phocadownload/pd1.jpg[/img]
[img]https://joomlanl.nl/images/phocadownload/pd2.jpg[/img]
[img]https://joomlanl.nl/images/phocadownload/pd3.jpg[/img]
Joomla 5.4.8
PHP 8.3.
Max upload size in PHP 64MB

[Jan]

Hi, do you get some error message when uploading? Did you try to check another files, another file extensions.

[christine]

Hi,

some generell infos and/or ideas:

Technical Requirements: https://manual.joomla.org/docs/next/get ... uirements/
also: Recommended PHP Memory Limit: at least 256MB

You should also set `post_max_size` to a value greater than `upload_max_filesize`, or at least exactly the same.
Example:

Code: Select all

upload_max_filesize = 128M
post_max_size = 128M

You can do this via cPanel -> Select PHP Version -> Options if you are using cPanel or you may be able to edit the php.ini file in the root folder of your website. Ask your web host.

Kind regards,
Christine

[Astrid]

Hi Jan,

Follow-up on this: it's not a size or php.ini issue, and not Admin Tools either. I traced it to Joomla core's own file upload safety check.

Error shown with debugging on:

Code: Select all

Joomla\Filesystem\File::upload: File not uploaded for security reasons!
libraries/vendor/joomla/filesystem/src/File.php:328
called from administrator/components/com_phocadownload/libraries/phocadownload/file/fileupload.php:314 (PhocaDownloadFileUpload::realMultipleUpload)

This check scans the raw bytes of the uploaded file for forbidden extension strings (.php, .py, .pl, etc.), and it's enough for those strings to appear anywhere in the file, including inside a zip's file listing. Any zip that contains .php files (any Joomla package or extension, including a plain 2MB update zip I tested) will always trigger this, since filenames inside a zip are stored uncompressed.

This started for us right after updating to Joomla 5.4.8 on 18 August. The 5.4.8 changelog includes PR #48080 "Update joomla/filesystem from 3.2.0 to 3.3.0 and partly backport PR 48038 from 6.1-dev" — PR #48038 originally fixed a different upload-breaking regression in the 6.1 line caused by joomla/filesystem 4.2.0. It looks like backporting that fix into the 5.4 filesystem package changed how/when this content safety check applies, and now it's also triggering during the backend "multiple upload" in Phoca Download, even though our "Activate XSS Check" setting is set to "Yes (Frontend only)".

Uploads worked fine on 5.4.7 (also from 8 July), broke after updating to 5.4.8. Not size, PHP limits, permissions, or WAF related — confirmed via error log, browser network tab, and manual byte-scanning of the zip.

Could this be reported upstream to the Joomla core team, and/or could Phoca Download pass allowUnsafe (or otherwise bypass this specific check) for its own trusted backend uploads?

Reproduce:
https://joomlanl.nl/images/phocadownload/pd_own.jpg
Github:
https://github.com/joomla/joomla-cms/pull/48080
Thanks,
Astrid

[Jan]

Hi, thank you for the info, the only way for now seems to be uploading such zip outside Joomla functions, means e.g. per FTP or SSH

Phoca Download calls the function File::Upload and unfortunately there is no parameter for set allowUnsafe, etc. I will try to ask for some possible solutions bur for now really hard to say

[Astrid]

Hi Jan,
Already uploaded my files using ftp, but thought it's usefull for other users explaining why it doesn't work.

[Jan]

OK