Issue: Attachment previews

See AdminCP > Wiki > Content > Attachment rules. For the JPG and PNG types at least, you have a Maximum File Size of 1 byte, as well as Maximum Width and Maximum Height of 1 pixel. This means that your image uploads are being resized to 1x1 images before being saved.

Technically all your images should be rejected based on these rules (it is impossible to have a valid image file be 1 byte), so there appears to be a security problem going on as well.

Likewise AdminCP > Setup > Options > VaultWiki: Content Types > Attachment thumbnail size is set to a 1x1 thumbnail size.

Interesting, hadn't seen those sections. I don't remember setting that!

Okay I've set max image dimensions to 2000x2000 and working.

Fun to note if I leave the thumbnail size as 1,1 and try to upload a 1000x600 png it doesn't upload and no user error is presented.

Instead in the admin panel I have:

Server error log
ErrorException: [E_WARNING] imagecreatetruecolor(): Invalid image dimensions src/addons/vw/vw/_core/model/image/format/vw.php:865
Generated by: Raigryn Vayd Nov 29, 2021 at 8:30 PM
Stack trace
#0 [internal function]: XF::handlePhpError(2, '[E_WARNING] ima...', 's...', 865, Array)
#1 src/addons/vw/vw/_core/model/image/format/vw.php(865): imagecreatetruecolor(1, 0)
#2 src/addons/vw/vw/_core/controller/dm/attach/thumb/vw.php(297): vw_Image_Format_Model->resize(1, 0, 'png')
#3 src/addons/vw/vw/_core/controller/dm/attach/thumb/vw.php(131): vw_DM_Attach_Thumb_Controller->create_thumbnail('png', Object(vw_Image_Format_PNG_Model), 1, 1)
#4 src/addons/vw/vw/XF/Entity/EntityBase.php(505): vw_DM_Attach_Thumb_Controller->pre_save(true)
#5 src/XF/Mvc/Entity/Entity.php(1357): vw\vw\XF\Entity\EntityBase->_preSave()
#6 src/addons/vw/vw/XF/Entity/EntityBase.php(496): XF\Mvc\Entity\Entity->preSave()
#7 src/addons/vw/vw/_core/controller/dm/xf2.php(367): vw\vw\XF\Entity\EntityBase->vwPreSave()
#8 src/addons/vw/vw/_core/controller/dm/attach/file/vw.php(1142): vw_DM_Controller_XF2->pre_save()
#9 src/addons/vw/vw/_core/controller/dm/attach/file/vw.php(414): vw_DM_Attach_File_Controller->create_thumbnails()
#10 src/addons/vw/vw/XF/Entity/EntityBase.php(660): vw_DM_Attach_File_Controller->post_save_each()
#11 src/XF/Mvc/Entity/Entity.php(1268): vw\vw\XF\Entity\EntityBase->_postSave()
#12 src/addons/vw/vw/XF/Entity/EntityBase.php(583): XF\Mvc\Entity\Entity->save(false, false)
#13 src/addons/vw/vw/_core/controller/dm/xf2.php(401): vw\vw\XF\Entity\EntityBase->vwSave()
#14 src/addons/vw/vw/_core/controller/ui/ajax/upload/vw.php(125): vw_DM_Controller_XF2->save()
#15 src/addons/vw/vw/Pub/Controller/Wiki/Ajax.php(51): vw_UI_AJAX_Upload_Controller->execute()
#16 src/addons/vw/vw/Mvc/Dispatcher.php(30): vw\vw\Pub\Controller\Wiki\Ajax->_actionIndex(Object(XF\Mvc\ParameterBag))
#17 src/addons/vw/vw/Pub/Controller/Wiki/AbstractController.php(26): vw\vw\Mvc\Dispatcher::dispatch(Object(vw\vw\Pub\Controlle r\Wiki\Ajax), 'index', Object(XF\Mvc\ParameterBag))
#18 src/XF/Mvc/Dispatcher.php(352): vw\vw\Pub\Controller\Wiki\AbstractController->actionIndex(Object(XF\Mvc\ParameterBag))
#19 src/XF/Mvc/Dispatcher.php(259): XF\Mvc\Dispatcher->dispatchClass('vw\\vw:Wiki\\Ajax', 'Index', Object(XF\Mvc\RouteMatch), Object(vw\vw\Pub\Controller\Wiki\Ajax), NULL)
#20 src/XF/Mvc/Dispatcher.php(115): XF\Mvc\Dispatcher->dispatchFromMatch(Object(XF\Mvc\RouteMatch), Object(vw\vw\Pub\Controller\Wiki\Ajax), NULL)
#21 src/XF/Mvc/Dispatcher.php(57): XF\Mvc\Dispatcher->dispatchLoop(Object(XF\Mvc\RouteMatch))
#22 src/XF/App.php(2345): XF\Mvc\Dispatcher->run()
#23 src/XF.php(512): XF\App->run()
#24 index.php(20): XF::runApp('XF\\Pub\\App')
#25 {main}
Request state
array(4) {
["url"] => string(34) "/index.php?Folklore-ajax/&c=upload"
["referrer"] => string(97) "https://chroniclesrp.net/Folklore/Board-Story?do=create&itemtypeid=17&etid=1&ecid=0&eaid=4&efid=0 "
["_GET"] => array(2) {
["Folklore-ajax/"] => string(0) ""
["c"] => string(6) "upload"
}
["_POST"] => array(5) {
["ajax"] => string(1) "1"
["_xfToken"] => string(8) "********"
["c"] => string(6) "upload"
["areaid"] => string(1) "4"
["pageid"] => string(0) ""
}
}



Maybe this needs an error catch and something meaningful presented to the user?

This should be fixed in the next build. We should always assume that a dimension is at least 1 pixel long.