Dolibarr/dolibarr · error

Error: Using the image wrapper to output a file ending with…

Error message

Error: Using the image wrapper to output a file ending with .noexe is not allowed.

What it means

viewimage.php is an image/file wrapper; this guard fires when the requested file's resolved MIME type (from dol_mimetype or the 'type' parameter) contains 'html'. It blocks serving HTML through the image wrapper to prevent stored-XSS/phishing delivery of attacker-controlled HTML from the documents directory.

Solutions

1. Do not serve HTML files through viewimage.php; use the appropriate download endpoint (document.php) instead
2. Serve only genuine image MIME types through this wrapper
3. Rename or remove uploaded HTML files from the documents directory
4. Sanitize uploads at ingestion: reject or quarantine HTML/SVG-with-script content

When it happens

Trigger: Thrown at htdocs/viewimage.php:263 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Dolibarr/dolibarr@598aa4bdad (2026-09-14). Data as JSON: /api/errors/467982dbcec8eddd. Report an issue: GitHub.

Appendix: source

Thrown at htdocs/viewimage.php:263

		httponly_accessforbidden("ErrorFileNotFoundWithSharedLink", 403, 1);
	}
}

// Define mime type
$type = 'application/octet-stream';
if (GETPOST('type', 'alpha')) {
	$type = GETPOST('type', 'alpha');
} else {
	$type = dol_mimetype($original_file);
}

// Security: This wrapper is for images. We do not allow type/html
if (preg_match('/html/i', $type)) {
	httponly_accessforbidden('Error: Using the image wrapper to output a file with a mime type HTML is not possible.');
}
// Security: This wrapper is for images. We do not allow files ending with .noexe
if (preg_match('/\.noexe$/i', $original_file)) {
	httponly_accessforbidden('Error: Using the image wrapper to output a file ending with .noexe is not allowed.');
}

// Security: Delete string ../ or ..\ into $original_file
$original_file = preg_replace('/\.\.+/', '..', $original_file);	// Replace '... or more' with '..'
$original_file = str_replace('../', '/', $original_file);
$original_file = str_replace('..\\', '/', $original_file);

// Find the subdirectory name as the reference
$refname = basename(dirname($original_file)."/");
if ($refname == 'thumbs') {
	// If we get the thumbs directory, we must go one step higher. For example original_file='10/thumbs/myfile_small.jpg' -> refname='10'
	$refname = basename(dirname(dirname($original_file))."/");
}

// Check that file is allowed for view with viewimage.php
if (!empty($original_file) && !dolIsAllowedForPreview($original_file)) {
	httponly_accessforbidden('This file extension is not qualified for preview', 403);
}

View on GitHub (pinned to 598aa4bdad)