Dolibarr/dolibarr · warning

Error: Using the image wrapper to output a file with a mime…

Error message

Error: Using the image wrapper to output a file with a mime type HTML is not possible.

What it means

viewimage.php is an image-only wrapper: if dol_mimetype() of the resolved file matches /html/i it blocks output with 'Error: Using the image wrapper to output a file with a mime type HTML is not possible.' This prevents serving active content (HTML, which can contain JS) through the image endpoint and sidestep content-type protections.

Solutions

1. Serve HTML files through document.php (with proper download headers) instead of viewimage.php
2. Remove/rename the HTML file or store previews as real images (PNG/JPEG)
3. If you only meant to display an image, fix the file parameter to point at the actual image
4. For custom previews, generate a static PNG snapshot of the HTML instead of serving raw HTML

Example fix

// before
<img src="viewimage.php?modulepart=medias&file=upload/page.html">
// after
<a href="document.php?modulepart=medias&original_file=upload/page.html">Open page</a>

if (preg_match('/html/i', dol_mimetype($file)) || preg_match('/\.(html?|xhtml)$/i', $file)) { throw new InvalidArgumentException('Use document.php for HTML files'); }

function isImageFile(string $f): bool { $t = dol_mimetype($f); return strpos($t, 'image/') === 0 && !preg_match('/html/i', $t); }

When it happens

Trigger: Request to viewimage.php with file param pointing to an .html/.htm file or any file whose detected mime type contains 'html' (e.g. file=page.html, or a file saved without extension but with HTML content type detection).

Common situations: Developers trying to reuse the image wrapper to display uploaded HTML previews; CMS/medias uploads mixing html files with images and templating loops that render all uploads through viewimage; files renamed with image extensions but detected by content.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• Access to a page that needs a token (constant…
• Access to this page this way (POST method or GET with a…
• If you access your server behind a proxy using url…
• ErrorLoginMustBePostMethod
• ErrorFileNameInvalid

AI-assisted analysis of Dolibarr/dolibarr@598aa4bdad (2026-09-14). Data as JSON: /api/errors/ba3ee5e61356c123. Report an issue: GitHub.

Appendix: source

Thrown at htdocs/viewimage.php:259

		if ($extname) {
			$original_file = getImageFileNameForSize($original_file, $extname);
		}
	} else {
		httponly_accessforbidden("ErrorFileNotFoundWithSharedLink", 403, 1);
	}
}

// Define mime type
$type = 'application/octet-stream';
if (GETPOST('type', 'alpha')) {
	$type = GETPOST('type', 'alpha');
} else {
	$type = dol_mimetype($original_file);
}

// Security: This wrapper is for images. We do not allow type/html
if (preg_match('/html/i', $type)) {
	httponly_accessforbidden('Error: Using the image wrapper to output a file with a mime type HTML is not possible.');
}
// Security: This wrapper is for images. We do not allow files ending with .noexe
if (preg_match('/\.noexe$/i', $original_file)) {
	httponly_accessforbidden('Error: Using the image wrapper to output a file ending with .noexe is not allowed.');
}

// Security: Delete string ../ or ..\ into $original_file
$original_file = preg_replace('/\.\.+/', '..', $original_file);	// Replace '... or more' with '..'
$original_file = str_replace('../', '/', $original_file);
$original_file = str_replace('..\\', '/', $original_file);

// Find the subdirectory name as the reference
$refname = basename(dirname($original_file)."/");
if ($refname == 'thumbs') {
	// If we get the thumbs directory, we must go one step higher. For example original_file='10/thumbs/myfile_small.jpg' -> refname='10'
	$refname = basename(dirname(dirname($original_file))."/");
}

View on GitHub (pinned to 598aa4bdad)