search

RotherOSS / otobo

OTOBO is one of the most flexible web-based ticketing systems used for Customer Service, Help Desk, IT Service Management. https://otobo.io/
GNU General Public License v3.0
241 stars 72 forks source link

Response from Kernel/Modules/PictureUpload.pm handled incorrectly #2296

Open stefanhaerter opened 1 year ago

stefanhaerter commented 1 year ago

Tested with 10.0 and 10.1 in AgentTicketNote:

When trying to upload a non-picture-file (in my example, a .txt file) as an inline image, the server responds with:

<script type="text/javascript"> (function(){var d=document.domain;while (true){try{var A=window.parent.document.domain;break;}catch(e) {};d=d.replace(/.*?(?:\.|\$)/,'');if (d.length==0) break;try{document.domain=d;}catch (e){break;}}})(); window.parent.CKEDITOR.tools.callFunction(0, '', "The file is not an image that can be shown inline!"); </script>

But instead of the error message ("The file is not an image that can be shown inline!" in this case), an alert is shown which says: "Incorrect server response." I would suggest to show the actual error message as I assume it to be more helpful than the alert.

stefanhaerter commented 1 year ago

I did a bit of investigation. This seems to be due to the fact that CKEditor awaits JSON data as a result and Kernel/Modules/PictureUpload.pm tries to respond with a function in a script tag.