See issue SondagesPro issue https://gitlab.com/SondagesPro/coreAndTools/limeMpdf/-/issues/3

Hi ,

In LS4 Uploading SVG Files are restricted for security reasons .They files will be deleted after unzip. So the Plugin developper should replace the svg files (Even if the are integrated in a twig file) with png or jpeg files. But you have the possibility to upload it manually (At your own risk) to your own host.

@eddylackmann : it's Plugins upload, not template upload …

plugins upload alrteady allow PHP files …

And here : it's twig file with svg content …

I check : but bthhink rename .svg.twig to _svg.twig can work …

@eddylackmann : i confirm : same file renamed with .svg.twig : it's OK.

1. Any file with .svg inside : deleted : this is a bad control …
2. You can not allow php file but disallow svg

In LS4 Uploading SVG Files are restricted for security reasons .

You can not allow PHP (and js) file but not svg

They files will be deleted after unzip.

It's false here : any file contain .svg in name seems deleted (i can create a sample plugin)

But you have the possibility to upload it manually (At your own risk) to your own host.

We already show an alert about plugin : plugin contain PHP file . More risk than a XSS here …

    public function beforeActivate()
    {
        $checkFile = is_file("checkexist.svg.txt");
        if(!$checkFile) {
            $this->getEvent()->set("success",false);
            $this->getEvent()->set("message","The file didn't exist");
        }
    }

Capture d’écran du 2020-09-17 17-04-02.png (4,850 bytes)   

Capture d’écran du 2020-09-17 17-04-02.png (4,850 bytes)   

I the core problem related to the SVG or to the path settings? Because when uploading from a ZIP file the files get into a different folder /limesurvey/upload/... compared to uploading manually to /limesurvey/plugins which is the old, default plugin path e.g. at LS3.x.
It was mentioned that manually installing the plugin did the trick for the user so maybe it's the path problem?

@mazi in LS4 the new publing path is located at /limesurvey/upload/plugings/ it can be the problem if you hardcoded the path in your code.

Something i use a lot , in init
Yii::setPathOfAlias(get_class($this), dirname(__FILE__));

See https://github.com/LimeSurvey/LimeSurvey/commit/09a17aa296b366103184e4bc957a297d65d8944c

@DenisChenu yes i start to use it also ;) ! Thanx for the tip ;)

The status on this issue is not clear to me.
Is this now a problem of a hard coded path in the plugin or a problemin LimeSurvey?

Is this now a problem of a hard coded path in the plugin or a problemin LimeSurvey?

«plugin manager ommits installation of files in path upload/plugins/limeMpdf/views/subview/svg»

svg file was deleted when use upload plugins system in 4.X

Since plugin have php file : no reason to disable svg or any other file.
Like when we allo js file : no reason to disable svg.