Hot answers tagged

34

There is a better solution! You can change the XSS filtering member group by using some extra directives in your config file. Add the following, replacing the member group numbers as required; $config['xss_clean_member_group_exception'] = "1|6"; Using this method you can keep XSS filtering turned ON but remove it just for trusted members. I think you ...


13

The issue is that certain PDFs falsely trigger the XSS screener's detection routines. And yes, this IS still a bug, although it is fairly difficult to predict which PDFs will be affected. I have had consistent issues with: PDFs exported from Microsoft Word on any platform PDFs with embedded color profile data The best way around it if you only need certain ...


7

I assume that EE's native file upload functions use the Upload class, but what exactly does the Upload class do to validate and sanitize? Does it check MIME type using some sort of actual file analysis, or does it simply rely on what the browser reads it as? The Upload class uses the $_FILES array and it does use $_FILES[]['type'], but we do some ...


6

If a member is a channel entry (or tied to a channel entry) and you are open to using an add-on other than Assets, then Channel Images would be a good route. It automatically creates a separate upload subdirectory per entry. But it uses entry_id for the name of the subdirectory, so wouldn't quite be the setup you wanted for the subdirectory name.


5

I'm not sure how KREA Help Desk does its verification for file uploads. I know that for the core of EE, if you've chosen to allow uploads of all file types, the file then goes through a check to see if the extension shows up in the mimes.php file in the config directory and whether it passed the aforementioned XSS check. I test uploaded a php file to a ...


4

Currently, Helpdesk does not allow to upload PHP files. We have decided for this limitation to avoid a security issue when someone would email you PHP file, and by figuring out the path of attachments on your server, execute it. Even though it's possible to block PHP execution for some folders (eg. via .htaccess), most of the users don't know this so we ...


4

Did you check your channel's Posting Preferences? (Admin > Channels > Channel Prefs) Could "Automatically turn URLs and email addresses into links?" be turned on? This has caught me a few times in the past... While ugly, you could otherwise wrap the output with URL Decode tags. This fall under the heading of "quick and damned-dirty" tho.


4

I think it's a bug, look at this bug report: https://support.ellislab.com/bugs/detail/19732 Francois


3

I've seen instances where PDF uploads won't work in Firefox if you've got ExpressionEngine XSS filtering file uploads. In Admin -> Security and Session Preferences, set "Apply XSS Filtering to uploaded files?" to "No". I'm not a fan of disabling security measures like this, but I've found no other solution.


3

This is not a solution, but I am using EE 2.7 and have been able to narrow down the offending code. Simply commenting out these three lines allowed for my offending PDFs to pass. I personally am not using this in production, and I have spent time trying to modify the code to get it to work... with no luck. Maybe someone can use this information to help ...


3

If you need the JPGs for rendering on a page the Thumber add-on from ElectricPutty should do exactly what you need: {exp:thumber:create src='/uploads/documents/yourfile.pdf' page='2' extension='jpg' height='250' class='awesome' title='Click to download' link='yes'}


3

I just came across this issue too and it turns out while the EE filemanager doesn't mind a missing trailing slash on the server path, Assets does. Make sure your upload directory server path has a trailing slash. Resolved the issue for me.


2

I figured it out. The Browse Server button only appears when the upload directory belongs to the current site. In the Wygwam settings you can create different configurations. By default there are the Basic and Full configuration. You can use the clone function to duplicate the configuration you're using now. For me this is Basic. After you clone it you can ...


2

Brandon of P&T put out this extension for Wygwam a while back. It could be a place to start looking for appropriate hooks to accomplish this.


2

A few things that should help you out. 1) You should be using the EE instance. Normally you to the get_instance() in the constructor of your module and make it available as a class variable. 2) The do_upload method accepts a string with the name of the file upload field, not the value of the posted field. Your code should look somehting like this // ...


2

I use the Focus Labs 'master.config' system rather than the Bootstrap one but it's basically just a variation on the same theme AFAIK so hopefully this input will still be applicable. What I've found is that whilst, in theory, you're supposed to create the upload destinations before you can redefine them with your config file, in practice it is possible to ...


2

This is caused by not having a trailing slash on the server_path parameter in the upload directory config. The Focus Labs documentation within the master config doesn't include the slash $env_config['upload_preferences'] = array( 1 => array( 'name' => 'Uploads', 'server_path' => $images_path . '/uploads', '...


2

try to use this one 'pdf' => array('application/pdf', 'application/x-download', 'application/download') and tell me and you can always solve this problem by rename the mimeTypes.rdf file which you can find in AppData\Roaming\Mozilla\Firefox\Profiles\ Regard's.


1

have you checked your php max upload filesize?


1

I had a similar issue recently when PHP was reconfigured. It turned out PHP's fileinfo extension wasn't enabled. Fixing that fixed the upload problem I was having. Might at least be something to check on in your case too.


1

I was able to solve this problem. it turned out that there was a wrong FastCGI implemented on the server. My host implemented a new version of FastCGI and now the upload with assets works like it should.


1

Channel Files will probably do what you're looking to do. The "Limit Stored Files by Author" setting is probably what you're looking for, here's a screenshot of the fieldtype settings screen: http://www.devdemon.com/images/products/30/fieldtype.jpg You can buy it here: http://devot-ee.com/add-ons/channel-files


1

If you use S3 you don't need youtube. CloudFront even has streaming http://aws.amazon.com/cloudfront/streaming/


1

I don't believe there's an off the shelf Vimeo or YouTube uploader available currently. Would you be open to using Amazon S3 for storage? If so, you could use Pixel & Tonic's Assets which allows you to use S3 as a file upload folder.


1

Checked the permissions of the upload destination folder, make sure that PHP has permission to create files and folders. If the 'thumbs' folder exists in this destination make sure nothing odd has happen to that, and it's permissions are set correctly. EE should have created it but in the past I've deleted whole directories and uploaded local folders with a ...


1

Sounds like an addon is getting in the way. You can check to see if it's an Extension causing the issue by temporarily disable Extensions by adding this into your /system/expressionengine/config/config.php file: $config['allow_extensions'] = 'n';


1

This was a bug that has been fixed in Assets 2.2. See changelog.


1

Ah, OK… "SafeCracker File inherits the tags of the standard File field" …so I can just use the appropriate single variable parameter such as… {member_avatar:image_manipulation_short_name} Must read more carefully before posting!


1

You said page to image, but... if generating a PDF of the page would work for you then there are some add-ons that will convert ExpressionEngine pages to PDF: 2PDFcrowd Shine PDF EEI_Tcpdf PDF Press


1

This isn't possible with Assets: Assets does not track who uploaded a file, so this kind of association is not there.


Only top voted, non community-wiki answers of a minimum length are eligible