Skip to content

[772424][PHP 8.1][PS 8.2] Fix PrettyBlocks upload – comply with open_basedir#317

Closed
CySSoO wants to merge 1 commit intoPrestaSafe:mainfrom
CySSoO:fix-openbasedir-restriction
Closed

[772424][PHP 8.1][PS 8.2] Fix PrettyBlocks upload – comply with open_basedir#317
CySSoO wants to merge 1 commit intoPrestaSafe:mainfrom
CySSoO:fix-openbasedir-restriction

Conversation

@CySSoO
Copy link
Copy Markdown

@CySSoO CySSoO commented Aug 14, 2025

[772424][PHP 8.1][PS 8.2] Fix PrettyBlocks upload – comply with open_basedir

Description

This PR fixes an image upload issue in the PrettyBlocks module on the 772424 server (PHP 8.1, PrestaShop 8.2, no overrides).

Issue

  • Error open_basedir restriction in effect when calling move_uploaded_file().
  • The generated destination path pointed to the filesystem root (/...) instead of an open_basedir-allowed directory.

Fix

  • Force the upload destination inside the PrestaShop root (modules/prettyblocks/views/images/ by default).
  • Normalize and secure paths (realpath(), block .., remove $/ prefix).
  • Automatically create the target directory if missing.
  • Preserve original logic (allowed file types, MD5 suffix in filename, upload error handling).

Tests

  • ✅ Uploading valid images in PrettyBlocks → works, file is moved and public URL generated.
  • ✅ Uploading disallowed file types → blocked with proper error message.
  • ✅ Removing images → works without errors.
  • ✅ Verified all paths remain under _PS_ROOT_DIR_ → compliant with open_basedir.

Impact

  • No impact on PrestaShop core (no overrides).
  • PrettyBlocks remains compatible with PHP 8.1 and PS 8.2.
  • Reduces risk of path traversal (improved security).

Notes:

  • Ensure modules/prettyblocks/views/images/ is writable by www-data.
  • This patch can be backported to other environments with active open_basedir.

@PrestaSafe PrestaSafe closed this Feb 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants