Skip to content

Cant upload some images in Documents Module due to php code injection check when short_open_tag is On

Some legitimate images (see my dog's image attached for an example) can't be uploaded when php's short_open_tag is enabled.

That is because the function validateImage in vtlib/Vtiger/Functions.php does the following check:

$imageContents = file_get_contents($file_details['tmp_name']);
if (stripos($imageContents, $shortTagSupported ? "<?" : "<?php") !== false) { // suspicious dynamic content.
    $saveimage = 'false';
}

I'm guessing that the short open tag (<?) can be part of the contents of a legitimate image. In fact I'm attaching an image which causes this problem. If you open it with a text editor you will notice that in fact the <? is part of it. When turning short_open_tag off, you will be able to upload the image without any problem.

coco_bostezar