Issue with uploading images with special character in the name

phiw13

The issue: HTTP 500 error when uploading image

Are there any restrictions or server side filters that would affect uploading images with a special character (' aka U+0027 or ‘Apostrophe’) - e.g file'name.jpg?

We are experiencing this when uploading images using the Textpattern CMS upload widget (build with PHP + JS). The server response is HTTP 500 error. Uploading the same image with the troublesome character removed (file_name.jpg) works fine.

Uploading directly through SFTP also works fine.

Note - The same issue as been reported when doing the same image upload with Expression Engine.

Update — log per request:

[Thu Jun 02 23:06:24.243384 2022] [:error] [pid 32825] [client 131.129.8.190:33868] [client 131.129.8.190] ModSecurity: Access denied with code 44 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/etc/httpd/conf.modules.d/security.conf"] [line "26"] [id "200002"] [msg "Multipart request body failed strict validation:       PE 0,       BQ 0,       BW 0,       DB 0,       DA 0,       HF 0,       LF 0,       SM 0,       IQ 1,       IP 0,       IH 0,       FL 0"] [hostname "emps.l-c-n.com"] [uri "/textpattern/index.php"] [unique_id "YplCcCeVnj6@VCypQmtPGwAAABI"], referer: https://emps.l-c-n.com/textpattern/index.php?event=image&sort=id&dir=desc&page=1&search_method=id,name,category
[Thu Jun 02 23:06:24.243586 2022] [http:error] [pid 32825] [client 131.129.8.190:33868] AH01579: Invalid response status 44, referer: https://emps.l-c-n.com/textpattern/index.php?event=image&sort=id&dir=desc&page=1&search_method=id,name,category

sean

phiw13 Please check your app error log in ~/logs/apps/name_of_app to see what the specific error message is, then update your original post to include that info. We'll then be in a better position to have some idea of what the problem might be.

phiw13

sean

I have updated the original post, thanks for the suggestion. That is mod_security tripping over that troublesome character, right ?

sean

phiw13 That is mod_security tripping over that troublesome character, right ?

Looks like it!

You can confirm by disabling mod_security via your app's .htaccess file with the following directives:

<IfModule mod_security.c>
  SecFilterEngine Off
  SecFilterScanPOST Off
</IfModule>

Please give that a try and let me if that corrects the upload issue.

phiw13

That did not seem to help (same error).

But at least I can report back to the Textpattern people and we can see if it is possible to sanitise the file name before uploading, so that other people don’t have this issue.

Thanks for your help.

sean

phiw13 You're very welcome! I'll bring this to the attention of our sysadmins to see if we can adjust the mod_security config for this.

In the meantime here are a couple of possible workarounds:

If your app doesn't rely on Apache .htaccess directives then we could change the app to use Nginx/PHP-FPM (the Nginx stack doesn't use mod_security).
You could build a private Apache stack and use that to serve your app with whatever configuration you need.

phiw13

Textpattern CMS does make use of .htaccess directives. It does run fine with Nginx but requires its own set of directives, which as I understand it, is currently complicated at Opalstack.

I will investigate the other option though.

PS using the humble ' and its cousin " can be really troublesome in filenames when those are handled in scripts. I certainly wouldn’t want to weaken the security of the server for that small issue. It first came up in the Textpattern forums via another user, and other servers are equally affected.

Thanks for the help.

sean

phiw13 You're very welcome!