[7.x.x] - DEV: init.php::preupdate() error

[davide-alghi]

I'm updating my extensions installers/updaters, but...

If preupdate() function, in package's init.php, returns false, the import installation stops with error:

2026-03-12 11:41:22.3417 [error][] - vtlib\Deprecated::checkFileAccessForDeletion(cache/usermodule_1773312081.zip) - Sorry! Attempt to access restricted file. realfilepath: 
 - 0 vtlib/Vtiger/Deprecated.php:97  >>  App\Log->error('vtlib\\Deprecated::checkFileAccessForDeletion(cache/usermodule_1773312081.zip) - Sorry! Attempt to access restricted file. realfilepath: ')
 - 1 modules/Settings/ModuleManager/views/ModuleImport.php:159  >>  vtlib\Deprecated->checkFileAccessForDeletion('cache/usermodule_1773312081.zip')
 - 2 app/Controller/ExposeMethod.php:68  >>  Settings_ModuleManager_ModuleImport_View->importUserModuleStep3()
 - 3 modules/Settings/ModuleManager/views/ModuleImport.php:45  >>  Settings_ModuleManager_ModuleImport_View->invokeExposedMethod('importUserModuleStep3')
 - 4 include/main/WebUI.php:161  >>  Settings_ModuleManager_ModuleImport_View->process()
 - 5 index.php:26  >>  Vtiger_WebUI->process()
 - 6 public_html/index.php:13  >>  require('index.php')
2026-03-12 11:41:22.3419 [error][] - Sorry! Attempt to access restricted file.
App\Exceptions\AppException: Sorry! Attempt to access restricted file. in vtlib/Vtiger/Deprecated.php:98
Stack trace:
#0 modules/Settings/ModuleManager/views/ModuleImport.php(159): vtlib\Deprecated::checkFileAccessForDeletion()
#1 app/Controller/ExposeMethod.php(68): Settings_ModuleManager_ModuleImport_View->importUserModuleStep3()
#2 modules/Settings/ModuleManager/views/ModuleImport.php(45): Settings_ModuleManager_ModuleImport_View->invokeExposedMethod()
#3 include/main/WebUI.php(161): Settings_ModuleManager_ModuleImport_View->process()
#4 index.php(26): Vtiger_WebUI->process()
#5 public_html/index.php(13): require('...')
#6 {main}
 - 0 include/main/WebUI.php:164  >>  App\Log->error('Sorry! Attempt to access restricted file.
App\\Exceptions\\AppException: Sorry! Attempt to access restricted file. in vtlib/Vtiger/Deprecated.php:98
Stack trace:
#0 modules/Settings/ModuleManager/views/ModuleImport.php(159): vtlib\\Deprecated::checkFileAccessForDeletion()
#1 app/Controller/ExposeMethod.php(68): Settings_ModuleManager_ModuleImport_View->importUserModuleStep3()
#2 modules/Settings/ModuleManager/views/ModuleImport.php(45): Settings_ModuleManager_ModuleImport_View->invokeExposedMethod()
#3 include/main/WebUI.php(161): Settings_ModuleManager_ModuleImport_View->process()
#4 index.php(26): Vtiger_WebUI->process()
#5 public_html/index.php(13): require(\'...\')
#6 {main}')
 - 1 index.php:26  >>  Vtiger_WebUI->process()
 - 2 public_html/index.php:13  >>  require('index.php')

Maybe this is a regression, because in YF 6.5 it works fine.

Any help is appreciated.
Thanks

[davide-alghi]

the problem is in vtlib/Vtiger/PackageImport.php:599

it tries to delete (unlink) the zip file, but the zip file doesnt exists, it was already deleted

	public function import($zipfile, $overwrite = false)
	{
		$module = $this->getModuleNameFromZip($zipfile);
		if (null !== $module) {
			$zip = \App\Zip::openFile($zipfile, ['checkFiles' => false]);
			// If data is not yet available
			if (empty($this->_modulexml)) {
				$this->__parseManifestFile($zip);
			}
			$buildModuleArray = [];
			$installSequenceArray = [];
			$moduleBundle = (bool) $this->_modulexml->modulebundle;
			if (true === $moduleBundle) {
				$moduleList = (array) $this->_modulexml->modulelist;
				foreach ($moduleList as $moduleInfos) {
					foreach ($moduleInfos as $moduleInfo) {
						$moduleInfo = (array) $moduleInfo;
						$buildModuleArray[] = $moduleInfo;
						$installSequenceArray[] = $moduleInfo['install_sequence'];
					}
				}
				sort($installSequenceArray);
				$zip->unzip($this->getTemporaryFilePath());
				foreach ($installSequenceArray as $sequence) {
					foreach ($buildModuleArray as $moduleInfo) {
						if ($moduleInfo['install_sequence'] == $sequence) {
							$this->import($this->getTemporaryFilePath($moduleInfo['filepath']), $overwrite);
						}
					}
				}
			} else {
				$this->packageType = strtolower($this->_modulexml->type);
				switch ((string) $this->_modulexml->type) {
					case 'update':
						Functions::recurseDelete('cache/updates');
						$zip = \App\Zip::openFile($zipfile, ['checkFiles' => false]);
						$zip->extract('cache/updates');
						$this->importUpdate();
						unlink($zipfile); // < < < < < < < < < < < < < < < <
						break;
					case 'font':
						$this->importFont($zipfile);
						break;
					default:
						$this->initImport($zipfile, $overwrite);
						// Call module import function
						$this->importModule();
						break;
				}
			}
		}
		return $module;
	}

[davide-alghi]

I confirm. If preupdate() returns false, the "update" import process attempts to delete the zip file (cache/usermodule_00000000000.zip) twice. The first time with unlink($zipfile); reported in my previous comment (vtlib/Vtiger/PackageImport.php:599) and a second time in modules/Settings/ModuleManager/views/ModuleImport.php:159

\vtlib\Deprecated::checkFileAccessForDeletion($uploadFileName);
unlink($uploadFileName);

But checkFileAccessForDeletion() fails because $uploadFileName has already been deleted.

	public function importUserModuleStep3(App\Request $request)
	{
		$viewer = $this->getViewer($request);
		$qualifiedModuleName = $request->getModule(false);
		$importModuleName = $request->get('module_import_name');
		$uploadFile = $request->get('module_import_file');
		$uploadDir = Settings_ModuleManager_Module_Model::getUploadDirectory();
		$uploadFileName = "$uploadDir/$uploadFile";
		\vtlib\Deprecated::checkFileAccess($uploadFileName);

		$importModuleType = false;
		$importType = $request->getByType('module_import_type');
		if ('language' === strtolower($importType)) {
			$package = new vtlib\Language();
			$importModuleType = 'Language';
		} elseif ('layout' === strtolower($importType)) {
			$package = new vtlib\Layout();
			$importModuleType = 'Layout';
		} else {
			$package = new vtlib\Package();
		}
		$package->initParameters($request);
		$package->import($uploadFileName);

		if ($package->packageType) {
			$importModuleType = $package->packageType;
		}
		if ('' != $package->_errorText) {
			$viewer->assign('MODULEIMPORT_ERROR', $package->_errorText);
		}
		\vtlib\Deprecated::checkFileAccessForDeletion($uploadFileName); // < < < < < < < < < < < < < <
		unlink($uploadFileName);

		$viewer->assign('IMPORT_MODULE_TYPE', $importModuleType);
		$viewer->assign('IMPORT_MODULE_NAME', $importModuleName);
		$viewer->assign('MODULEIMPORT_LABEL', (string) ($package->_modulexml->label ?? $package->_modulexml->name));
		$viewer->assign('QUALIFIED_MODULE', $qualifiedModuleName);
		$viewer->view('ImportUserModuleStep3.tpl', $qualifiedModuleName);
	}

I think the fix is ​​to remove

unlink($zipfile);

in vtlib/Vtiger/PackageImport.php:599

[rskrzypczak]

@davide-alghi thx, I've created issue from this discussion. #247

[davide-alghi]

@rskrzypczak
have I to copy there (issues) my comments here?

[rskrzypczak]

There is no need for that. The issue refers to this discussion. ;)