0

I made a module using dynamic rows component with imageUploader field inside. I was able to upload my image on the Magento 2.3.2, but since the new release (2.3.3), I can't pass the valideFileId() method in the class \Magento\Framework\File\Uploader.

If I take a look at the valideFileId() method, here is what I see :

private function validateFileId(array $fileId): void
    {
        $isValid = false;
        if (isset($fileId['tmp_name'])) {
            $tmpName = trim($fileId['tmp_name']);

            if (preg_match('/\.\.(\\\|\/)/', $tmpName) !== 1) {
                $allowedFolders = [
                    sys_get_temp_dir(),
                    $this->directoryList->getPath(DirectoryList::MEDIA),
                    $this->directoryList->getPath(DirectoryList::VAR_DIR),
                    $this->directoryList->getPath(DirectoryList::TMP),
                    $this->directoryList->getPath(DirectoryList::UPLOAD),
                ];

                $disallowedFolders = [
                    $this->directoryList->getPath(DirectoryList::LOG),
                ];

                foreach ($allowedFolders as $allowedFolder) {
                    if (stripos($tmpName, $allowedFolder) === 0) {
                        $isValid = true;
                        break;
                    }
                }

                foreach ($disallowedFolders as $disallowedFolder) {
                    if (stripos($tmpName, $disallowedFolder) === 0) {
                        $isValid = false;
                        break;
                    }
                }
            }
        }

        if (!$isValid) {
            throw new \InvalidArgumentException(
                __('Invalid parameter given. A valid $fileId[tmp_name] is expected.')
            );
        }
    }

This private method is called from the _setUploadFileId() which is called in the constructor.

Here is this method on Magento 2.3.2:

 private function _setUploadFileId($fileId)
    {
        if (is_array($fileId)) {
            $this->_uploadType = self::MULTIPLE_STYLE;
            $this->_file = $fileId;
        } else {
            if (empty($_FILES)) {
                throw new \Exception('$_FILES array is empty');
            }

and now on Magento 2.3.3:

private function _setUploadFileId($fileId)
    {
       if (is_array($fileId)) {
            $this->validateFileId($fileId);
            $this->_uploadType = self::MULTIPLE_STYLE;
            $this->_file = $fileId;
        } else {
            if (empty($_FILES)) {
                throw new \DomainException('$_FILES array is empty');
            }

Here is the data that I send:

array(5) {
  ["name"]=>
  string(9) "image1.jpg"
  ["type"]=>
  string(10) "image/jpeg"
  ["tmp_name"]=>
  string(26) "/private/var/tmp/phpbPsgJz"
  ["error"]=>
  int(0)
  ["size"]=>
  int(72987)
}

Here is how I get my data:

$result = $this->imageUploader->saveFileToTmpDir($imageId);

imageUploader being the class \Magento\Catalog\Model\ImageUploader

My tmp_name is "/private/var/tmp/phpbPsgJz"

I run my project on Mac Os. Thanks for your help.

1

In some of Mac Os versions (or maybe in all, not sure) root "/var" folder is a symlink which points to "/var/private". Php "opens" this symlink for tmp file path in $_FILES archive, but sys_get_temp_dir() returns configured in php.ini value (or, if not configured default value whic is "var/tmp" ) So for validating sys_get_temp_dir() with real tmp file path just configure in your php.ini next values:

upload_tmp_dir = "/private/var/tmp/"
sys_temp_dir = "/private/var/tmp/"
| improve this answer | |
0

I found finally what was the issue. For some reason as I wrote, my tmp_name was "/private/var/tmp/phpbPsgJz" and the $allowedFolders are :

"/var/tmp/"
"/Users/me/www/magento2/pub/media"
"/Users/me/www/magento2/var"
"/Users/me/www/magento2/var/tmp"
"/Users/me/www/magento2/pub/media/upload"

I had to rename my tmp_name in order to remove the "private" but it's not a clean solution... Feel free to share your thoughts

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.