Maximum space for upload directory exceeded.

[tshore]

This happens when you try to use the WYSIWYG editor (TinyMCE) to add an image to your site. The plugin that TinyMCE is using is called JBImages. This is a bug - at least in the version of the code that I'm using (OCS 2.3.5). I've seen it reported a few other times, but, because it couldn't be reproduced, no one ever followed up on it.

In this file:

lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/jbimages/ci/application/controllers/editor.php

on line 174, replace this:

if ($maxUploadDirSize)

with this:

if ($uploadDirSizeExceeded)

Once I fixed the bug, I was thrilled to find out that I still could not upload an image using TinyMCE. The new error was:

The filetype you are attempting to upload is not allowed

This error is thrown by:

lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/jbimages/ci/system/libraries/Upload.php

in the function is_allowed_filetype().

It was failing the mime type check, and after a bit of debugging, it seemed that continuing would be too much trouble ($this->file_type was messed up, I think), so I just bailed and switched line 584 from:

public function is_allowed_filetype($ignore_mime = FALSE)

to:

public function is_allowed_filetype($ignore_mime = TRUE)

[asmecher]

Hi Trudy,

Beware that you may have opened up your system for uploads of malevolent files, e.g. PHP scripts. The code you've changed is in a third-party library so I'm not entirely sure of the implications, but it's worth double-checking.

Regards,
Alec Smecher
Public Knowledge Project Team

[tshore]

Alec - your scare tactics caused me to actually stay at this and find the problem - ugh. I can't believe that no one ever debugged this extension before. I mean, it's not a necessary feature, but surely people have tried to use it on a similar system to our server before?

Ok, so in this file:

lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/jbimages/ci/system/libraries/Upload.php

you need to replace this (around line 1058):

@exec('file --brief --mime-type ' . escapeshellarg($file['tmp_path']), $output, $return_code);

with this:

@exec('file --brief --mime-type ' . escapeshellarg($file['tmp_name']), $output, $return_code);

Will you guys file these two as bugs?

[asmecher]

Hi Trudy,

That's not a scare tactic -- your original change appears at a glance to have deactivated MIME type checking, which strikes me as risky. JBimages is a third-party extension to a third-party extension (TinyMCE) to our software so my knowledge of its internals is doubly limited. I'd suggest checking in with the author of JBImages (http://justboil.me/) to see what his take on your proposed change is.

Regards,
Alec Smecher
Public Knowledge Project Team