dsmcdonough

Here is a diff:

diff --git a/include/class.forms.php b/include/class.forms.php
index 19f825c2d..caa8fb7cc 100644
--- a/include/class.forms.php
+++ b/include/class.forms.php
@@ -3973,6 +3973,7 @@ class FileUploadField extends FormField {
     }
 
     static function isValidFile($file) {
+        var_dump($file['type'], FileObject::mime_type($file['tmp_name']));die;
         // Make sure mime type is valid
         if (strcasecmp(FileObject::mime_type($file['tmp_name']),
                     $file['type']) !== 0)

When you apply these changes, inspect the page and everything like the above, and look at the response you get in the Network tab. The first value will be the mime-type your browser is sending and the second value is what PHP is determining the mime type is (by scanning the file itself).

Cheers.

ItsMePasse

Applying the changes shouldn’t affect email sending unless you messed something up.

Cheers.

I'm having almost the same problem after the 1.17.3 version upgrade.

On our configuration we dont have any excepcion about MIME types and no exclusion list, but we now cant upload files with .png extension. All the other file extension we can upload without any problem. only .png returns "undefined 500" error on upload. With version 1.17.2 it was working just fine.
I've tried the fix posted here but the problem remains the same.

Hi Kevin,

First of all, thanks for your reply. I'm using the latest version of Microsoft Edge, If i go back to my backup version on 1.17.2 i dont have that "problem", php and mysql on the server are all the same versions. On my osTicket instalation this only happens on this new version. Should we wait for "fix"?

Thanks once again.

HugoBatel

Correct, in v1.17.3 we added further checks on file uploads for security reasons. I will quote my previous reply below:

If so there is nothing you can do except disable the check but you will open yourself up to security vulnerabilities. Do so at your own risk. We are looking into what else we can do as it appears the magic database compiled with PHP doesn't have all file mime types which is ass.

Cheers.

KevinTheJedi What lines do we remove for the checks?

Is it the two functions "isValidFileType"?

hhardy https://github.com/osTicket/osTicket/blob/develop/include/class.forms.php#L3975-L3977