Creating download file does not work! Github 27-08-2026 #6104
|
@e107help Creating a download does not work, no error message, form is only reloaded. With debug error messages: Warning Undefined array key "move_image", Line 1783 of /home//domains//private_html/e107_plugins/download/includes/admin.php Can you take a look at it? I'm getting the impression that I'm the only one testing all the functionality after all the recent changes; surely that can't be true? |
Replies: 2 comments 5 replies
|
@Alex-e107nl I didn't get to testing of download the plugin yet, so yes, probably, you are the only one. I am in the process of moving unnuke users to the e107 login/signup system; I can't do more testing now. |
|
Yeah you are working to much, i know but it is more to all the users of e107 now, when you read the https://github.com/e107inc/e107/releases v2.3.11 is a security release for sites on v2.3.10 or earlier. And all of the advisories you can do 2 things, get your e107 site offline or update! But when you update there are to much problems yet, so testing is the only way to go! Help is needed! |
|
With so much going on (especially a flood of AI-generated security reports) and limited time and resources, I haven't been able to add proactive test coverage in the untested areas that had security fixes. I am sorry for breaking the creation of downloads; I've sent @e107help to fix this. |
|
Fix is up as #6105, @Alex-e107nl, and it goes in the write path rather than in the download form, so no call site changes. Three parts to it. A typed write now resolves a null against the column it is going into: a column the table declares NOT NULL takes its own default, and anything else still gets SQL NULL. The connection can answer what that default is, read off the table rather than off a cached definition, because nothing clears that cache when a column is added or altered and a stale answer would have kept this same bug alive on upgraded sites. And Your On the testing: the branch adds an acceptance test that creates a download through the real form and then edits it. It is the first thing in the suite to open the download admin at all, so at least this hole stays shut from here. |
|
I will test the changes as soon as @Deltik accepts the fix, thx!, |
|
Confirmed, @Alex-e107nl, and it is our doing rather than anything on your side. Reproduced here on master of 27 August ( Stopgap while it is unfixed: create an empty folder What actually broke: with no such folder the form never posts I have not traced every line of your dump. The two undefined-key warnings I did chase, What I will recommend to Deltik is that the fix goes in the write path rather than in this one form, since the same swap moved every core call site of that helper and any of them could hand a null to a NOT NULL column. His call how it lands. On your last question, I can only tell you what the tests cover: nothing in our suite creates a download through the admin form, or opens that admin page at all, so this went in green. You are finding the places nobody automated. |
|
Yessss again you did it! Success |
Fix is up as #6105, @Alex-e107nl, and it goes in the write path rather than in the download form, so no call site changes.
Three parts to it. A typed write now resolves a null against the column it is going into: a column the table declares NOT NULL takes its own default, and anything else still gets SQL NULL. The connection can answer what that default is, read off the table rather than off a cached definition, because nothing clears that cache when a column is added or altered and a stale answer would have kept this same bug alive on upgraded sites. And
insertGetId(), the shorthand this form goes through, no longer forces the untyped path, which is what quietly downgraded fifteen calls …