Cover Image Cannot be Uploaded on Windows Server using the REST endpoint

[oddev56]

BuddyPress version 6.1.0.

When using the REST endpoint for updating the member cover image (​https://developer.buddypress.org/bp-rest-api/reference/attachments/member-cover-image/#definition-2), the error "The cover image directory is not valid" is returned.

The issue is present in the file bp-core/trait-attachments.php on line 84, where the validate_file function is failing:

if ( 0 !== validate_file( $cover_dir )

! is_dir( $cover_dir ) ) {

Changing it to:

if ( 1 === validate_file( $cover_dir )

! is_dir( $cover_dir ) ) {

Fixes the issue.

This same issue was present in the bp-core/bp-core-attachments.php file and was fixed with a patch, please see ticket #7674 for more information on this:

1) Ticket link: ​https://buddypress.trac.wordpress.org/ticket/7674
2) Patch link: ​https://buddypress.trac.wordpress.org/attachment/ticket/7674/7674.01.patch

[espellcaste]

@oddev56 Thank you for raising that. I created a pull request in the REST API repo with the fix: ​https://github.com/buddypress/BP-REST/pull/348

Would you be willing to test that pull request and see if it works in your Windows environment? Since I don't have a Windows environment setup.

Otherwise, will try to see if someone in the team has a Windows environment setup to test/confirm the patch/update.

[oddev56]

Replying to espellcaste:

@oddev56 Thank you for raising that. I created a pull request in the REST API repo with the fix: ​https://github.com/buddypress/BP-REST/pull/348

Would you be willing to test that pull request and see if it works in your Windows environment? Since I don't have a Windows environment setup.

Otherwise, will try to see if someone in the team has a Windows environment setup to test/confirm the patch/update.

Hello @espellcaste , thanks for the quick response!.

You missed the change to the condition, it should check if it equals (===) 1. So (0 !==) should be changed to (1 ===).

I can't test the pull request, but can assure you that i made that change and tested it on my Windows Server and it works correctly, as the previous patch to this issue on the non REST part.

I'm currently working on a project that will be released soon and needs this feature to let users change their cover image, it would be great if this fix could be integrated into the next BuddyPress update, so i won't have to instruct my clients to make this change manually.

[imath]

Hi @oddev56 I'm sorry but we have nothing to change there. The WordPress function validate_file() must return 0 to validate the file, otherwise something is wrong with the file. If you get the error code 1 then it means the file path you used is either:

• equals to ../ which is forbidden,
• has more than one occurence of ../ which is not allowed,
• or has ../ not occuring at the end of the path which is not allowed.

Are you filtering the default BuddyPress upload path? If so remove your filter and test again, imho the path you're returning to the upload path filter is not good.

[oddev56]

Replying to imath:

Hi @oddev56 I'm sorry but we have nothing to change there. The WordPress function validate_file() must return 0 to validate the file, otherwise something is wrong with the file. If you get the error code 1 then it means the file path you used is either:

• equals to ../ which is forbidden,
• has more than one occurence of ../ which is not allowed,
• or has ../ not occuring at the end of the path which is not allowed.

Are you filtering the default BuddyPress upload path? If so remove your filter and test again, imho the path you're returning to the upload path filter is not good.

Hello @imath , thanks for your reply.

This is the same issue that was fixed 2 years ago on the bp-core/bp-core-attachments.php file, please check the ticket and patch linked on my first comment:

1) Ticket link: ​https://buddypress.trac.wordpress.org/ticket/7674
2) Patch link: ​https://buddypress.trac.wordpress.org/attachment/ticket/7674/7674.01.patch

You can check the discussion there as to what the issue is with windows servers and the validate_file function and why this was changed.

Please check that the current bp-core/bp-core-attachments.php file (​https://github.com/buddypress/BuddyPress/blob/master/src/bp-core/bp-core-attachments.php) always compares validate_file to 1, to fix this issue on windows servers, but it seems that this fix wasn't taken into consideration when creating the REST endpoint that allows for cover image uploads.

[imath]

Thanks for insisting @oddev56

It's fixed into the master branch of the BP REST plugin, which will be included in BuddyPress 7.0.0.

See: ​https://github.com/buddypress/BP-REST/commit/8da1d521fbbc0f272db610dd4242ab78f72f05fe