cedric-anne
commented
1 year ago Hi,
Can you provide the payload that can be used to reproduce this issue ?
I tested a call with following payload on POST http://glpi/apirest.php/Document/ and it successfully created the file:
{
"headers": {
"App-Token": "********",
"Session-Token": "********"
},
"multipart": [
{
"name": "uploadManifest",
"contents": "{\"input\":{\"name\":\"API upload test\",\"_filename\":[\"test.txt\"]}}"
},
{
"name": "filename1229194340[]",
"contents": "A simple text file\nto test API upload.\n\n",
"filename": "test.txt"
}
]
}
trasher
Code of Conduct
Is there an existing issue for this?
Version
10.0.3
Bug description
When uploading a document through the API requests if the document name is not longer than 23 characters it returns the error 'Unauthorized file type'.
Relevant log output
No response
Page URL
apirest.php/Document
Steps To reproduce
Your GLPI setup information
Información sobre la instalación y configuración del sistema
Server
Operating system: Linux xes3 5.15.0-50-generic #56~20.04.1-Ubuntu SMP Tue Sep 27 15:51:29 UTC 2022 x86_64 PHP 8.0.24 apache2handler (Core, FFI, PDO, Phar, Reflection, SPL, SimpleXML, Zend OPcache, apache2handler, apcu, bz2, calendar, ctype, curl, date, dom, exif, fileinfo, filter, ftp, gd, gettext, hash, iconv, intl, json, ldap, libxml, mbstring, mysqli, mysqlnd, openssl, pcre, pdo_mysql, posix, readline, session, shmop, snmp, soap, sockets, sodium, standard, sysvmsg, sysvsem, sysvshm, tokenizer, xml, xmlreader, xmlrpc, xmlwriter, xsl, zip, zlib) Setup: max_execution_time="600" memory_limit="512M" post_max_size="30M" safe_mode="" session.save_handler="files" upload_max_filesize="50M" Software: Apache () Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:106.0) Gecko/20100101 Firefox/106.0 Server Software: Ubuntu 20.04 Server Version: 10.3.34-MariaDB-0ubuntu0.20.04.1 Server SQL Mode: STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION Parameters: glpirw@localhost/glpidb Host info: Localhost via UNIX socket PHP version (8.0.24) is supported. Sessions configuration is OK. Allocated memory is sufficient. mysqli extension is installed. Following extensions are installed: dom, fileinfo, json, simplexml. curl extension is installed. gd extension is installed. intl extension is installed. libxml extension is installed. zlib extension is installed. The constant SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES is present. Database engine version (10.3.34) is supported. The log file has been created successfully. Write access to /var/www/html/glpi/files/_cache has been validated. Write access to /var/www/html/glpi/config has been validated. Write access to /var/www/html/glpi/files/_cron has been validated. Write access to /var/www/html/glpi/files has been validated. Write access to /var/www/html/glpi/files/_dumps has been validated. Write access to /var/www/html/glpi/files/_graphs has been validated. Write access to /var/www/html/glpi/files/_lock has been validated. Write access to /var/www/html/glpi/files/_pictures has been validated. Write access to /var/www/html/glpi/files/_plugins has been validated. Write access to /var/www/html/glpi/files/_rss has been validated. Write access to /var/www/html/glpi/files/_sessions has been validated. Write access to /var/www/html/glpi/files/_tmp has been validated. Write access to /var/www/html/glpi/files/_uploads has been validated. Web access to files directory is protected Sessions configuration is secured. exif extension is installed. ldap extension is installed. openssl extension is installed. zip extension is installed. bz2 extension is installed. Zend OPcache extension is installed. Following extensions are installed: ctype, iconv, mbstring, sodium. Write access to /var/www/html/glpi/marketplace has been validated. Timezones seems loaded in database.GLPI constants
Libraries
SQL replicas
Notifications
Plugins list
accounts Name: Accounts Version: 3.0.2 State: Enabled Install Method: Manual actualtime Name: ActualTime Version: 2.0.0 State: Enabled Install Method: Manual advancedplanning Name: advancedplanning Version: 1.1.0 State: Enabled Install Method: Marketplace news Name: Alerts Version: 1.10.5 State: Enabled Install Method: Marketplace handover Name: Assets Handover Version: 2.0.0 State: Enabled Install Method: Manual barcode Name: Barcode Version: 2.7.1 State: Enabled Install Method: Marketplace behaviors Name: Behaviours Version: 2.7.1 State: Enabled Install Method: Manual byemail Name: ByEmail Version: 2.0.0 State: Enabled Install Method: Manual charge Name: Charges Version: 2.0.0 State: Enabled Install Method: Manual costs Name: Costs Version: 3.0.1 State: Enabled Install Method: Marketplace credit Name: Credit vouchers Version: 1.11.2 State: Enabled Install Method: Marketplace datainjection Name: Data injection Version: 2.12.0 State: Enabled Install Method: Marketplace escalade Name: Escalation Version: 2.8.0 State: Enabled Install Method: Marketplace formcreator Name: Form Creator Version: 2.13.2 State: Enabled Install Method: Marketplace gantt Name: gantt Version: 1.0.1 State: Enabled Install Method: Marketplace gappextended Name: Gapp eXtended Version: 2.0.0 State: Enabled Install Method: Manual gdrive Name: GDrive Version: 1.3.0 State: Installed / not activated Install Method: Marketplace gitsync Name: GitSync Version: 2.0.0 State: Enabled Install Method: Manual glpiinventory Name: GLPI Inventory Version: 1.0.4 State: Installed / not activated Install Method: Marketplace uninstall Name: Item's Lifecycle (uninstall) Version: 2.8.0 State: Enabled Install Method: Marketplace jsaddons Name: JS Addons Version: 2.0.0 State: Enabled Install Method: Marketplace kpi Name: KPI Version: 1.0.0 State: Enabled Install Method: Manual oauthimap Name: Oauth IMAP Version: 1.4.1 State: Enabled Install Method: Marketplace oauthsso Name: oauthsso Version: 1.5.2 State: Enabled Install Method: Marketplace onetimesecret Name: OneTimeSecret Version: 2.0.0 State: Enabled Install Method: Marketplace order Name: Orders management Version: 2.9.0 State: Enabled Install Method: Marketplace permissions Name: Permissions Version: 1.3.1 State: Installed / not activated Install Method: Manual signaturit Name: Signaturit Version: 1.0.0 State: Enabled Install Method: Manual tam Name: TAM Version: 1.4.4 State: Enabled Install Method: Manual taskdrop Name: TaskDrop Version: 2.0.0 State: Enabled Install Method: Marketplace tviewer Name: TViewer Version: 1.1.0 State: Installed / not activated Install Method: Manual vehicle Name: Vehicle Version: 1.2.1 State: Enabled Install Method: Manual voip Name: VoIP Version: 0.7.2 State: Enabled Install Method: Manual waypoint Name: Waypoint Version: 1.3.0 State: Enabled Install Method: Manual yagp Name: yagp Version: 2.1.0 State: Enabled Install Method: MarketplaceLocales overrides
Anything else?
I think the error is caused in the class
src/GLPIUploadHandler.phpline 156$val->prefix = substr($val->name, 0, 23);If the name has less than 23 characters it stores in 'prefix' the extension of the document causing that when the function
moveUploadedDocumentof the classsrc/Document.phpis executed it removes the extension at line 1152$filename = str_replace($prefix, '', $filename);