[0.90.1] Upload document not working with Internet Explorer 11

[barbuslex]

Hi,

The upload of a document not working with Internet Explorer 11.

If i configure IE in "IE 9" compatibility mode, the upload working, the document upload succefully.
If i let IE in "Edge" compatibility mode the document never upload :

Same issue with IE in "IE 10" compatibility mode.
The upload seems to not working with Internet Explorer version > 9.

I use Internet Explorer 11 in Windows 7 64 bits.

Thanks to solve it

++

[orthagh]

Hello @barbuslex

see this issue #196.

If you have an autlogon (ntlm) enabled, it should be same as this issue

[barbuslex]

Hi @orthagh !

Yes i have NTLM autologon enabled.

/front/fileupload.php not exists in GLPI 0.90.1 :(

And i don't have vhost in my server... is it possible to set it in htaccess file ?

Thanks for your reply,

++

[orthagh]

front/fileupload.php still here :)

.htacess (in front folder) should work if your hosting service provider has enable AllowOverride to all with this kind of code (not tested) :

<Files fileupload.php>
     Satisfy Any
 </Files>

[barbuslex]

Yes my bad...

I use Apache 2.4 so i do a .htaccess file like this in /front/ folder :

<Files fileupload.php>
    Require all granted
</Files>

Is it possible to add this file in future version of GLPI ?

Now when i try to upload document (pdf file) i get this error :

Have you an idea @orthagh ?

Thanks for your help.

[orthagh]

I close this ticket for now (initial bug refer to #196)
For future integration, it's difficult, its a bug in toolchain IE+NTLM but i keep it in mind.

For your last error, it's a normal behavior, glpi manage a list of authorized extensions in Configuration > Dropdowns > Document Types.
You can add a new type (with its extension) for enable upload of your file.

[barbuslex]

It's working.... i just replace :

Deny from all

by :

Require all denied

On each .htaccess files of GLPI.

[barbuslex]

I reopen the issue because the problem of the file extension appears a hit on two :

• First try :
  

Reponse of fileupload.php

{"filename":[{"name":"1450279181-2944","size":0,"type":"multipart\/form-data; boundary=---------------------------7dfa22953003e","error":"Type de fichier non autoris\u00e9","id":"docfilename755000581"}]}

• Second try :
  

Response of fileupload.php :

{"filename":[{"name":"Fichier pdf.pdf","size":24835,"type":"application\/pdf","url":"http:\/\/server\/glpi\/front\/files\/Fichier%20pdf.pdf","deleteUrl":"http:\/\/server\/glpi\/front\/?filenam=Fichier%20pdf.pdf","deleteType":"DELETE","display":"Fichier pdf.pdf 24.25 Kio","filesize":"24.25 Kio","id":"docfilename476096772"}]}

I observe this behavior on all browsers...

Have you an idea @orthagh ?

Thanks in advance

[orthagh]

same filename or extension ?

[barbuslex]

Yes the filename is : "Fichier pdf.pdf"

[orthagh]

In your first case, first filename seems to be 1450279181-2944

Cannot find why ?

[barbuslex]

I don't understand why, i upload the same file in 2 case.

Maybe temp filename on server ?

I see the type is differrent too : multipart/form-data
Instead of : application/pdf

[barbuslex]

Have you see the url generated on second case @orthagh ?

http://server/glpi**/front/files/**Fichier pdf.pdf

Would not it should be a thing like this :

http://server/glpi**/files/**Fichier pdf.pdf

???

[barbuslex]

Currently the problem disappeared.

Perhaps a problem in the PHP server sessions.

I close the ticket.

[barbuslex]

The issue appears again its a real problem for uploading document

[barbuslex]

This issue is critical beaucause my users cannot add a file to their tickets.
Anyone can help me ?

[tomolimo]

Hello
to help troubleshoot this, you may use fiddler to spy network exchanges bewtween IE and Server.
With fildler you shoul dbe able to see if the strange file name is comming from server or from IE.

[barbuslex]

Hi @tomolimo,

Thanks for your reply.
It was very difficult to reproduce the issue. But i managed to produce a .saz file with Fiddler4.

My manipulations:

• Connected to GLPI with super-admin user
• Helpdesk / New Ticket
• Add file to ticket / Browse...
• Select "Fichier PDF.pdf"

Result:

• 1st upload: unallowed file type
• 2nd upload: unallowed file type
• 3rd upload: success upload file

You can find the .saz file here: https://drive.google.com/file/d/0B5OckHsCwP3dZzllakkwOFBPcUE/view?usp=sharing

Have you an idea ?

Here my server configuration :

• Windows Server 2008 R2 64 bits
• Apache 2.4.18 x64 VC11
• PHP 5.5.31 NTS x64 VC11 (Configured in fcgid mode)
• MariaDB 10.0.23 64 bits

Thanks for your help.

[tomolimo]

Hello,
I can see that you are using NTLM with Apache x64: where did you get the module?
I can see an upgrade to it: https://www.apachehaus.com/cgi-bin/download.plx
I believe there is a problem in configuration or in module itself.
Could you update and redo a test/trace? But this time from start of IE and not only from upload of file?
thank you,
regards,
Tomolimo

PS: in the past I tried also such configuration and switched to IIS7.5 as IIS natively managed NTML.
But at the end I cancelled use of NTML as it needs three roundtrips with web server to get authorized. As we are using GLPI internally (same LAN, no external connection), I wrote a small JS script that gets user name from Windows and sends it to GLPI.

[barbuslex]

@tomolimo

It's apachehaus.com's mod_authn_ntlm module that i use.
What is the update for this module ? I see 1.0 version in mod_authn_ntml-1.0-2.4.x-x64-vc11.zip.

I don't understand... when i retry to upload i have 100% of success upload now. It's really mysterious.

Previously, when i have the problem, the file wasn't put in /glpi/files/_tmp folder.

When upload works the file uploaded (Fichier PDF.pdf) is present in /glpi/files/_tmp folder.

Here you can find the full trace. The problem occurs in line 809. Previous try are succefull upload.
Between each upload i was delete the "Fichier PDF.pdf" in /glpi/files/_tmp.

The file /glpi/front/fileupload.php is out of ntlm authentication with .htaccess file.
/glpi/font/.htaccess file content :

<Files fileupload.php>
    Require all granted
</Files>

Here the .saz file : https://drive.google.com/file/d/0B5OckHsCwP3dTXU3dzlQQ3pWT1E/view?usp=sharing

[barbuslex]

Here the fcgid config for apache :

FcgidInitialEnv PHPRC "C:\\www\\php"
FcgidInitialEnv SystemRoot "C:\\Windows"
FcgidInitialEnv SystemDrive "C:"
FcgidInitialEnv TEMP "C:\\WINDOWS\\TEMP"
FcgidInitialEnv TMP "C:\\WINDOWS\\TEMP"
FcgidInitialEnv windir "C:\\WINDOWS"

FcgidIOTimeout 3600
FcgidOutputBufferSize 64
FcgidBusyTimeout 360
FcgidProcessLifeTime 3600
FcgidMaxProcesses 64
FcgidMaxProcessesPerClass 8
FcgidMinProcessesPerClass 0
FcgidConnectTimeout 360
FcgidIdleScanInterval 0
FcgidIdleTimeout  360
FcgidMaxRequestLen 1073741824

<Files ~ "\.php$">
    Options +ExecCGI
    AddHandler fcgid-script .php
    FcgidWrapper "C:/www/php/php-cgi.exe" .php
</Files>

[tomolimo]

Thank you,
I'll look at the traces, and keep you informed.
Sorry for misleading you about the module upgrade I missed the real version number of the module on "apache haus".

Also did you look at this #196?

[tomolimo]

The trace you sent are for IE compatibility mode don't they?
Could redo them with no compatibility flag set? I mean normal IE11 mode?
As I prefer to try to debug normal mode rather than compatibility mode :)
Thank you
Tomolimo

PS: you may drag/drop your zip file directly into the post in github.

[barbuslex]

Yes the solution of @orthagh has applied in htaccess.
My Windows Server and Internet Explorer 11 are up to date (Tuesday Patch of January 2016)

[barbuslex]

@tomolimo
Yes but it does not influence the manifestation of the problem.
Here traces in IE 11 in Edge mode.
I do not reach the zip document in github. (Probably too big).
Here is the link of the .saz file (the problem occurs in line 566): https://drive.google.com/file/d/0B5OckHsCwP3dMEhKUkMxUTFid2s/view?usp=sharing

[tomolimo]

It's a new VM with Win7 enterprise SP1

[barbuslex]

I have found another document upload library validated with Internet Explorer : http://docs.fineuploader.com/branch/master/browser-support.html

[barbuslex]

I just see that the script is under license (not open source) :(

[tomolimo]

For free or open-source project is written the following:

If you are developing an open-source or free product and will not derive any money from the product using Fine Uploader, you may use Fine Uploader free of charge under the Widen Commercial License.

[barbuslex]

Ok, but this script seems to be little be more complex than jquery-file-upload.
What is the files in GLPI responsible for uploading document (js and php) ?

[tomolimo]

For me the initial problem comes from IE Pre-Authentication behaviour.

Could you try the following?

on your IE computer: start regedit

HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Internet Settings/
Add the following registry value:

Value Name: DisableNTLMPreAuth
Data Type: REG_DWORD
Value: 1

restart your computer,
on server: enable anonymous by default, and enable NTLM only for /glpi/index.php and /glpi/front/login.php (of course disable NTLM everywere else). Be sure that anonymous is disabled for those two files.
restart Apache.

and test. In fiddler traces you should only get one or two http 401 for /glpi/index.php (or /glpi/)

[barbuslex]

I have applied your reg key on my system and i have reboot.

In apache i set in /glpi/.htaccess :

<Files index.php>
AuthName "Accès restreint"
AuthType SSPI
NTLMAuth On
NTLMAuthoritative On
NTLMOfferBasic On
NTLMPerRequestAuth On
require valid-user
</Files>

And in /glpi/front/.htaccess :

<Files login.php>
AuthName "Accès restreint"
AuthType SSPI
NTLMAuth On
NTLMAuthoritative On
NTLMOfferBasic On
NTLMPerRequestAuth On
require valid-user
</Files>

But the NTLM not working now... GLPI prompt username/password on index.php.

Have you an idea ?

Thanks

[tomolimo]

Could you try to disable Basic auth for index.php?

NTLMOfferBasic Off

Otherwise, IE will use Basic as it is accepted by server...

[barbuslex]

It's good. NTLM authentication works again.

I do this in /glpi/.htaccess :

<Files ~ "^$|index.php|login.php">
    AuthName "Accès restreint"
    AuthType SSPI
    NTLMAuth On
    NTLMAuthoritative On
    NTLMOfferBasic Off
    NTLMPerRequestAuth On
    require valid-user
</Files>

I made you a trace immediately (if I can reproduce the problem).

[tomolimo]

Did you also change your registry?

[barbuslex]

Yes i have patched my registry. The issue seems to to be solved, I continue my tests to be sure.
On your IIS environment with this solution does it work?

[tomolimo]

Yes :)

[tomolimo]

and for you it should be slightly quicker (shorter response time) as IE will not send authentication request to each requested page.

[barbuslex]

Ok, i like this way ;)
Yes indeed it is faster to load.

On machines without the registry patch the problem persists. Changing NTLM authentication had no effect.

I continued my tests on machines with registry patch...

[tomolimo]

yes you need both due to this:

Note Microsoft Internet Explorer requires NTLM authentication for all visits after you visit one NTLM authenticated folder.
ref: https://support.microsoft.com/en-us/kb/251404

[barbuslex]

Ok, i have deployed the fix on all machines. I will test more tomorrow.

[barbuslex]

How can you found this fix ?

[tomolimo]

???

[barbuslex]

I answered too quickly ^^
How can did you found this fix ?

[tomolimo]

Do you mean: how did you find this fix?

[barbuslex]

Yes ^^

[tomolimo]

Long story:

1. When I installed GLPI 0.83.8 for our internal use: I first started with Apache 2.4 (three years ago), and then I switched to IIS when I saw too much problems with: NTLM, scalability, and responsetime (yes IIS has better performance than Apache), and also when I saw that a lot of support were existing for PHP on IIS.
2. I saw at this time a lot of network traffic due to NTLM (= three round trip for each authentication), and tried at this time to have only some part of the web site to be NTLM and the rest to be anonymous. I didn't succeed for two reasons: a) IE didn't pay attention to server param (as soon as it is using NTLM, then for the whole site it is using NTLM). b) Didn't find at this time how to have only one file with NTLM on IIS server.
3. I decided then to develop another login mechanism (poor of course, but compatible with IE). used in a javascript an activeX that permits to get username from computer environment variables, and the same javascript sends this username to the server back to index.php. This script is still in use on our production server. This is SSO without NTLM (so no special network round trips), but works only in IE (due to activeX).
4. I saw that in your traces you've got two problems: a) each page were asking authentication (due to SSPIPerRequestAuth On and that b) even when NTLM was disabled for fileupload.php, sometimes NTLM header was sent by IE.
5. it remembered me what I saw and described above:)
6. I've created a new VM with Win7 enterprise x64 with IE11 to be able to test IE11 (as we don't currently use IE11, but still IE10 in our company, I was not able to test on my PC with IE11). And with this VM I was not able to reproduce exact behavior of your IE11 (as I don't have Apache, but IIS), But being able to trace more or less the same effects.
7. Doing these searches, I learnt how to configure IIS for NTLM just for one (or two) files (such preventing round trips).
8. And for sure I've applied these on my GLPI 0.90.1 and 0.91 servers (dev and tests). And I'll apply these also to my next GLPI 0.91 prod server.

regards,
Tomolimo

[barbuslex]

Okay ^^ !
I can not reproduce the problem today.
So we can close the ticket. I will open it ever again if the problem recurs.

[barbuslex]

Thanks so much for your help @tomolimo ;)

[DrKak]

Hello,
I have the same issue with IE11 and upload files, I disabled with registry key but dosent work.

There is another things to do ?

Thanks

[tomolimo]

Please post in another issue as this one is closed!

[barbuslex]

Reboot your computer after apply the reg key.