4

I'm using the KREA HelpDesk plugin. Sometimes when I send a response I want to attach an updated file for the customer to test.

If I try to attach a PHP file to the ticket, I get the message "Error: This file type is not allowed". I can understand the security issue here, files shouldn't be uploaded to the server with the php extension because users could run them. However:

  • There are ways around this, if the file was uploaded with a *.bin extension or something it would mitigate the security issue.
  • If I reply to ticket via email and attach a PHP file it works fine.

I've already tried disabling the notorious "Apply XSS Filtering to uploaded files" setting in EE. Has anyone else run into this? Is it a HelpDesk problem or an EE problem? Has anyone found a solution to let HelpDesk/EE accept *.php uploads?

Improve this question
2
  • Having just searched an EE project for 'this file type' I'm not seeing any matching language items, so presumably this is addon-specific rather than something EE's blocking.
    – Dom Stubbs
    Nov 21, 2012 at 8:36
  • Just noticed another site that is running over HTTPS is preventing file uploads in the CP and for the initial form that is filled out by a user. When the site is loaded over HTTP both the CP and Front-End file uploads work.
    – Justin Long
    Nov 21, 2012 at 10:14

2 Answers 2

Reset to default
5

I'm not sure how KREA Help Desk does its verification for file uploads. I know that for the core of EE, if you've chosen to allow uploads of all file types, the file then goes through a check to see if the extension shows up in the mimes.php file in the config directory and whether it passed the aforementioned XSS check. I test uploaded a php file to a directory set to allow all file types, and it went in without a hitch, so either KREA is doing different checks, you're set up to allow a different set of filetypes, or somehow the php extension doesn't show up in your mimes.php file.

It's entirely possible that none of that helps you, but I do hope it can point you towards the right answer.

Improve this answer
1
  • Good to know it's not a standard EE issue. I'll follow it up with KREA support then.
    – Adrian Macneil
    Nov 21, 2012 at 23:40
4

Currently, Helpdesk does not allow to upload PHP files. We have decided for this limitation to avoid a security issue when someone would email you PHP file, and by figuring out the path of attachments on your server, execute it.

Even though it's possible to block PHP execution for some folders (eg. via .htaccess), most of the users don't know this so we have decided to disallow PHP file attachments at the moment.

The workaround for this is to ask your users to send you PHP attachments in a .zip file.

Improve this answer
1
  • But as I mentioned, it works fine if you email the file. It's only a problem uploading from the CP.
    – Adrian Macneil
    Nov 22, 2012 at 20:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.