Dolibarr/dolibarr · error

This file extension is not qualified for preview

Error message

This file extension is not qualified for preview

What it means

The wrapper rejects any requested file whose name ends with .noexe. .noexe is a Dolibarr convention for files that must never be executed or rendered (e.g. renamed executables stored in the documents tree), so serving one via viewimage.php is blocked regardless of its apparent MIME type.

Solutions

1. Do not request .noexe files through viewimage.php; strip or rename the extension only after verifying content safety
2. Serve the file through the intended download endpoint if it is meant to be downloaded, not previewed
3. Remove the .noexe suffix server-side once the file has been verified safe
4. Fix the calling code or URL that points the image wrapper at a .noexe file

When it happens

Trigger: Thrown at htdocs/viewimage.php:280 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Dolibarr/dolibarr@598aa4bdad (2026-09-14). Data as JSON: /api/errors/fd711b7bb4ca52b7. Report an issue: GitHub.

Appendix: source

Thrown at htdocs/viewimage.php:280

if (preg_match('/\.noexe$/i', $original_file)) {
	httponly_accessforbidden('Error: Using the image wrapper to output a file ending with .noexe is not allowed.');
}

// Security: Delete string ../ or ..\ into $original_file
$original_file = preg_replace('/\.\.+/', '..', $original_file);	// Replace '... or more' with '..'
$original_file = str_replace('../', '/', $original_file);
$original_file = str_replace('..\\', '/', $original_file);

// Find the subdirectory name as the reference
$refname = basename(dirname($original_file)."/");
if ($refname == 'thumbs') {
	// If we get the thumbs directory, we must go one step higher. For example original_file='10/thumbs/myfile_small.jpg' -> refname='10'
	$refname = basename(dirname(dirname($original_file))."/");
}

// Check that file is allowed for view with viewimage.php
if (!empty($original_file) && !dolIsAllowedForPreview($original_file)) {
	httponly_accessforbidden('This file extension is not qualified for preview', 403);
}

// Security check
if (empty($modulepart)) {
	httponly_accessforbidden('Bad value for parameter modulepart', 400);
}

// When logged in a different entity, medias cannot be accessed because $conf->$module->multidir_output
// is not set on the requested entity, but they are public documents, so reset entity
if ($modulepart === 'medias' && $entity != $conf->entity) {
	$conf->entity = $entity;
	$conf->setValues($db);
}

$check_access = dol_check_secure_access_document($modulepart, $original_file, $entity, $user, $refname);
$accessallowed              = $check_access['accessallowed'];
$sqlprotectagainstexternals = $check_access['sqlprotectagainstexternals'];
$fullpath_original_file     = $check_access['original_file']; // $fullpath_original_file is now a full path name

View on GitHub (pinned to 598aa4bdad)