Skip to content

Fix: programmatic image uploads fail when ImageContentInterface::NAME has no extension#5

Open
milorad-smartweb wants to merge 1 commit intomarkshust:mainfrom
milorad-smartweb:fix/programmatic-image-upload-extension
Open

Fix: programmatic image uploads fail when ImageContentInterface::NAME has no extension#5
milorad-smartweb wants to merge 1 commit intomarkshust:mainfrom
milorad-smartweb:fix/programmatic-image-upload-extension

Conversation

@milorad-smartweb
Copy link

Fixes #3

Problem

When images are assigned programmatically via Product::addImageToMediaGallery()
(e.g. CLI import), Magento core stores ImageContentInterface::NAME as
$pathinfo['filename'] — without a file extension.

During productRepository::save(), MediaGalleryProcessor passes this name to
ImageProcessor::processImageContent(). The Uploader then validates the extension
of the name field against the allowlist set by this plugin. Since the name has no
extension, '' is not in ['jpg', 'jpeg', 'gif', 'png'] and the upload is rejected.
The exception is silently caught, getUploadedFileName() returns null, and a
subsequent processor->addImage() call throws "The image doesn't exist".

Fix

Before setting allowed extensions on the Uploader, check whether the image content
name already has an extension. If not, derive it from the MIME type (which Magento
has already validated at this point) and set it on the content object. This ensures
both programmatic and form-based uploads pass the extension check without any
reduction in security.

Testing

  • Admin panel image upload: still works, security maintained
  • CLI/programmatic addImageToMediaGallery: no longer throws "The image doesn't exist"
  • Tested on Magento 2.4.7-p9, PHP 8.3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Image upload issues after applying polyshell patch (Image not found + resize not working)

1 participant