View Issue Details

Related ChangesetsJump to NotesJump to History
This bug affects 1 person(s).
 258
IDProjectCategoryView StatusDate SubmittedLast Update
11394Bug reportsSecuritypublic2016-06-16 09:122016-06-17 08:45
Reporterasshank Assigned Toc_schmitz  
PrioritynoneSeverityminor 
Status closedResolutionfixed 
Product Version2.50.x 
Fixed in Version2.50.x 
Summary11394: file upload error reveals absolute path
Description

If file upload has errors, the message contains the absolute path to the tmp/ directory.

This exposure should imho be avoided, merely stating that the temporary directory has errrors is beter.

Steps To Reproduce

do a file upload and try to trigger an error

Additional Information

change the locales (.po) should do the trick...

"An error occurred uploading your file. This may be caused by incorrect permissions in your %s folder."

into

"An error occurred uploading your file. This may be caused by incorrect permissions in the temporary folder or the file is too large."

This will make the message better.. also mentioning a possible file too large reason

TagsNo tags attached.
Bug heat258
Complete LimeSurvey version number (& build)160614
I will donate to the project if issue is resolvedNo
Browser-
Database type & version258
Server OS (if known)-
Webserver software & version (if known)-
PHP Version-

Users monitoring this issue

There are no users monitoring this issue.

Activities

DenisChenu

DenisChenu

2016-06-16 09:26

developer   ~39614

Maybe show path only of have superadmin right (then not for public).
asshank

asshank

2016-06-16 10:05

reporter   ~39619

Good idea!

More detailed info (crossed my mind) for superadmin but that is more of a feature request.

That said: The file-upload proces returns more errors and so can give a more accurate errormessage. Permission is one of them, but also exceeding the max_file_uploads can be determined.
c_schmitz

c_schmitz

2016-06-16 10:19

administrator   ~39621

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=19471
asshank

asshank

2016-06-16 19:15

reporter   ~39633

Last edited: 2016-06-16 19:22

Don't forget to update the locales:

"An error occurred uploading your file. This may be caused by incorrect permissions for the application /tmp folder." is not translated yet in version 160616. I think!
c_schmitz

c_schmitz

2016-06-16 20:25

administrator   ~39634

What locales?
pmonstad

pmonstad

2016-06-16 20:55

updater   ~39635

language files? String exists in language files?
asshank

asshank

2016-06-16 21:28

reporter   ~39636

I think I'm not familiar with the way the .po (.mo) are managed.
I checked https://limesurvey.org/community-services/contribute/translations-status (dutch .po) and did not find the string.
So I gathered... .po not updated.

The limesurvey.pot has the right string (autocompiled I think)

So I guess I have to wait :-)

My bad!?
c_schmitz

c_schmitz

2016-06-16 23:02

administrator   ~39637

Yes, that happens automatically.
c_schmitz

c_schmitz

2016-06-17 08:45

administrator   ~39638

Version 2.50+ Build 160616 released

Related Changesets

LimeSurvey: master d321db37

2016-06-16 10:19

c_schmitz


Details Diff		 Fixed issue 11394: [security] File upload error path revelation Affected Issues
11394
mod - application/controllers/admin/dataentry.php Diff File
mod - application/controllers/admin/labels.php Diff File
mod - application/controllers/admin/participantsaction.php Diff File
mod - application/controllers/admin/questiongroups.php Diff File
mod - application/controllers/admin/questions.php Diff File
mod - application/controllers/admin/surveyadmin.php Diff File
mod - application/controllers/admin/templates.php Diff File

Issue History

Date Modified Username Field Change
2016-06-16 09:12 asshank New Issue
2016-06-16 09:26 DenisChenu Note Added: 39614
2016-06-16 09:59 c_schmitz Assigned To => c_schmitz
2016-06-16 09:59 c_schmitz Status new => assigned
2016-06-16 10:05 asshank Note Added: 39619
2016-06-16 10:19 c_schmitz Changeset attached => LimeSurvey master d321db37
2016-06-16 10:19 c_schmitz Note Added: 39621
2016-06-16 10:19 c_schmitz Resolution open => fixed
2016-06-16 19:15 asshank Note Added: 39633
2016-06-16 19:22 asshank Note Edited: 39633
2016-06-16 20:25 c_schmitz Note Added: 39634
2016-06-16 20:55 pmonstad Note Added: 39635
2016-06-16 21:28 asshank Note Added: 39636
2016-06-16 23:02 c_schmitz Note Added: 39637
2016-06-16 23:02 c_schmitz Status assigned => resolved
2016-06-16 23:02 c_schmitz Fixed in Version => 2.5
2016-06-17 08:45 c_schmitz Note Added: 39638
2016-06-17 08:45 c_schmitz Status resolved => closed