20783: When upload a forbidden extension with debug 7 : recive 500 error

This issue affects 1 person(s).

ID	Project	Category	View Status	Date Submitted	Last Update
20783	Bug reports	Survey editing	public	2026-10-21 12:03	2026-10-21 12:05

Reporter	DenisChenu	Assigned To
Priority	none	Severity	minor
Status	new	Resolution	open
Product Version	7.7.x

Summary	20783: When upload a forbidden extension with debug 7 : recive 500 error
Description	When debug set : htmlentities(): Passing null to parameter #2 ($flags) of type int is deprecated /media/shnoulle/data/www/master/assets/packages/kcfinder/core/class/browser.php(922)
Steps To Reproduce	Steps to reproduce Set debug=2 Create a surey Edit text, upload a PDF : OK Try to upload a lss or lsg file Expected result receive File type forbidden Actual result Error
Tags	No tags attached.
Attached Files	uploaderror.html (7,314 bytes) <div class="container"> <h1>PHP error</h1> <p class="message"> htmlentities(): Passing null to parameter #2 ($flags) of type int is deprecated </p> <div class="source"> <p class="file">/media/shnoulle/data/www/master/assets/packages/kcfinder/core/class/browser.php(922)</p> <div class="code"><pre><span class="ln">910</span> protected function errorMsg($message, ?array $data=null) { <span class="ln">911</span> if (in_array($this->action, array("thumb", "upload", "download", "downloadDir"))) <span class="ln">912</span> die($this->label($message, $data)); <span class="ln">913</span> if (($this->action === null) \|\| ($this->action == "browser")) <span class="ln">914</span> $this->backMsg($message, $data); <span class="ln">915</span> else { <span class="ln">916</span> $message = $this->label($message, $data); <span class="ln">917</span> die(json_encode(array('error' => $message))); <span class="ln">918</span> } <span class="ln">919</span> } <span class="ln">920</span> <span class="ln">921</span> protected function htmlData($str) { <span class="error"><span class="ln error-ln">922</span> return htmlentities((string) $str, null, strtoupper($this->charset)); </span><span class="ln">923</span> } <span class="ln">924</span> } <span class="ln">925</span> <span class="ln">926</span> ?> </pre></div> </div> <div class="traces"> <h2>Stack Trace</h2> <table style="width:100%;"> <tbody><tr class="trace app expanded"> <td class="number"> #0 </td> <td class="content"> <div class="trace-file"> <div class="plus">+</div> <div class="minus">–</div>  /media/shnoulle/data/www/master/assets/packages/kcfinder/core/class/browser.php(922): <strong>htmlentities</strong>("limesurvey_group_66.lsg", null, "UTF-8") </div> <div class="code"><pre><span class="ln">917</span> die(json_encode(array('error' => $message))); <span class="ln">918</span> } <span class="ln">919</span> } <span class="ln">920</span> <span class="ln">921</span> protected function htmlData($str) { <span class="error"><span class="ln error-ln">922</span> return htmlentities((string) $str, null, strtoupper($this->charset)); </span><span class="ln">923</span> } <span class="ln">924</span> } <span class="ln">925</span> <span class="ln">926</span> ?> </pre></div> </td> </tr> <tr class="trace app expanded"> <td class="number"> #1 </td> <td class="content"> <div class="trace-file"> <div class="plus">+</div> <div class="minus">–</div>  /media/shnoulle/data/www/master/assets/packages/kcfinder/core/class/browser.php(712): <strong>kcfinder\browser</strong>-><strong>htmlData</strong>("limesurvey_group_66.lsg") </div> <div class="code"><pre><span class="ln">707</span> $message = $this->checkUploadedFile($file); <span class="ln">708</span> <span class="ln">709</span> if ($message !== true) { <span class="ln">710</span> if (isset($file['tmp_name'])) <span class="ln">711</span> @unlink($file['tmp_name']); <span class="error"><span class="ln error-ln">712</span> return $this->htmlData($file['name']) . ": " . $message; </span><span class="ln">713</span> } <span class="ln">714</span> <span class="ln">715</span> $filename = $this->normalizeFilename($file['name']); <span class="ln">716</span> $target = "$dir/" . file::getInexistantFilename($filename, $dir); <span class="ln">717</span> </pre></div> </td> </tr> <tr class="trace app expanded"> <td class="number"> #2 </td> <td class="content"> <div class="trace-file"> <div class="plus">+</div> <div class="minus">–</div>  /media/shnoulle/data/www/master/assets/packages/kcfinder/core/class/browser.php(301): <strong>kcfinder\browser</strong>-><strong>moveUploadFile</strong>(array("name" => "limesurvey_group_66.lsg", "tmp_name" => "/tmp/phpmdECan", "error" => 0), "/media/shnoulle/data/www/master/upload/surveys/797994/images/") </div> <div class="code"><pre><span class="ln">296</span> $this->errorMsg("Cannot access or write to upload folder."); <span class="ln">297</span> <span class="ln">298</span> if (is_array($this->file['name'])) { <span class="ln">299</span> $return = array(); <span class="ln">300</span> foreach ($this->file['name'] as $i => $name) { <span class="error"><span class="ln error-ln">301</span> $return[] = $this->moveUploadFile(array( </span><span class="ln">302</span> 'name' => $name, <span class="ln">303</span> 'tmp_name' => $this->file['tmp_name'][$i], <span class="ln">304</span> 'error' => $this->file['error'][$i] <span class="ln">305</span> ), $dir); <span class="ln">306</span> } </pre></div> </td> </tr> <tr class="trace app collapsed"> <td class="number"> #3 </td> <td class="content"> <div class="trace-file"> <div class="plus">+</div> <div class="minus">–</div>  /media/shnoulle/data/www/master/assets/packages/kcfinder/core/class/browser.php(132): <strong>kcfinder\browser</strong>-><strong>act_upload</strong>() </div> <div class="code"><pre><span class="ln">127</span> (substr((string) $act, 0, 8) != "download") && <span class="ln">128</span> !in_array($act, array("thumb", "upload")) <span class="ln">129</span> ) <span class="ln">130</span> header("Content-Type: text/plain; charset={$this->charset}"); <span class="ln">131</span> <span class="error"><span class="ln error-ln">132</span> $return = $this->$method(); </span><span class="ln">133</span> echo ($return === true) <span class="ln">134</span> ? '{}' <span class="ln">135</span> : $return; <span class="ln">136</span> } <span class="ln">137</span> </pre></div> </td> </tr> <tr class="trace app collapsed"> <td class="number"> #4 </td> <td class="content"> <div class="trace-file"> <div class="plus">+</div> <div class="minus">–</div>  /media/shnoulle/data/www/master/assets/packages/kcfinder/browse.php(18): <strong>kcfinder\browser</strong>-><strong>action</strong>() </div> <div class="code"><pre><span class="ln">13</span> */ <span class="ln">14</span> <span class="ln">15</span> require "core/bootstrap.php"; <span class="ln">16</span> $browser = "kcfinder\\browser"; // To execute core/bootstrap.php on older <span class="ln">17</span> $browser = new $browser(); // PHP versions (even PHP 4) <span class="error"><span class="ln error-ln">18</span> $browser->action(); </span><span class="ln">19</span> <span class="ln">20</span> ?></pre></div> </td> </tr> </tbody></table> </div> <div class="version"> 2026-10-21 09:58:13 nginx/1.26.3 <a href="https://www.yiiframework.com/">Yii Framework</a>/1.1.33-dev </div> </div> uploaderror.html (7,314 bytes) Capture d’écran du 2026-10-21 11-58-25.png (126,393 bytes)

Bug heat	2
Complete LimeSurvey version number (& build)	7.7.0
I will donate to the project if issue is resolved	No
Browser	not relevant
Database type & version	not relevant
Server OS (if known)	debian
Webserver software & version (if known)	nginx
PHP Version	php 8.3
Git branch / Pull Request URL	N/A

User List	There are no users monitoring this issue.

Date Modified	Username	Field	Change
2026-10-21 12:03	DenisChenu	New Issue
2026-10-21 12:03	DenisChenu	File Added: uploaderror.html
2026-10-21 12:03	DenisChenu	File Added: Capture d’écran du 2026-10-21 11-58-25.png
2026-10-21 12:05	DenisChenu	Note Added: 86662
2026-10-21 12:05	DenisChenu	File Added: Capture d’écran du 2026-10-21 12-04-59.png
2026-10-21 12:05	DenisChenu	Bug heat	0 => 2

View Issue Details

Steps to reproduce

Expected result

Actual result

Users monitoring this issue

Activities

Issue History

DenisChenu 2026-10-21 12:05 developer ~86662	Must be (debug=0) Capture d’écran du 2026-10-21 12-04-59.png (26,143 bytes) Capture d’écran du 2026-10-21 12-04-59.png (26,143 bytes)