Skip to content

Conversation

@CySSoO
Copy link

@CySSoO CySSoO commented Aug 14, 2025

[772424][PHP 8.1][PS 8.2] Fix PrettyBlocks upload – comply with open_basedir

Description

This PR fixes an image upload issue in the PrettyBlocks module on the 772424 server (PHP 8.1, PrestaShop 8.2, no overrides).

Issue

  • Error open_basedir restriction in effect when calling move_uploaded_file().
  • The generated destination path pointed to the filesystem root (/...) instead of an open_basedir-allowed directory.

Fix

  • Force the upload destination inside the PrestaShop root (modules/prettyblocks/views/images/ by default).
  • Normalize and secure paths (realpath(), block .., remove $/ prefix).
  • Automatically create the target directory if missing.
  • Preserve original logic (allowed file types, MD5 suffix in filename, upload error handling).

Tests

  • ✅ Uploading valid images in PrettyBlocks → works, file is moved and public URL generated.
  • ✅ Uploading disallowed file types → blocked with proper error message.
  • ✅ Removing images → works without errors.
  • ✅ Verified all paths remain under _PS_ROOT_DIR_ → compliant with open_basedir.

Impact

  • No impact on PrestaShop core (no overrides).
  • PrettyBlocks remains compatible with PHP 8.1 and PS 8.2.
  • Reduces risk of path traversal (improved security).

Notes:

  • Ensure modules/prettyblocks/views/images/ is writable by www-data.
  • This patch can be backported to other environments with active open_basedir.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant