{"record":{"id":"467982dbcec8eddd","repo":"Dolibarr/dolibarr","slug":"error-using-the-image-wrapper-to-output-a-file-ending-with","errorCode":null,"errorMessage":"Error: Using the image wrapper to output a file ending with .noexe is not allowed.","messagePattern":"Error: Using the image wrapper to output a file ending with \\.noexe is not allowed\\.","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"htdocs/viewimage.php","lineNumber":263,"sourceCode":"\t\thttponly_accessforbidden(\"ErrorFileNotFoundWithSharedLink\", 403, 1);\n\t}\n}\n\n// Define mime type\n$type = 'application/octet-stream';\nif (GETPOST('type', 'alpha')) {\n\t$type = GETPOST('type', 'alpha');\n} else {\n\t$type = dol_mimetype($original_file);\n}\n\n// Security: This wrapper is for images. We do not allow type/html\nif (preg_match('/html/i', $type)) {\n\thttponly_accessforbidden('Error: Using the image wrapper to output a file with a mime type HTML is not possible.');\n}\n// Security: This wrapper is for images. We do not allow files ending with .noexe\nif (preg_match('/\\.noexe$/i', $original_file)) {\n\thttponly_accessforbidden('Error: Using the image wrapper to output a file ending with .noexe is not allowed.');\n}\n\n// Security: Delete string ../ or ..\\ into $original_file\n$original_file = preg_replace('/\\.\\.+/', '..', $original_file);\t// Replace '... or more' with '..'\n$original_file = str_replace('../', '/', $original_file);\n$original_file = str_replace('..\\\\', '/', $original_file);\n\n// Find the subdirectory name as the reference\n$refname = basename(dirname($original_file).\"/\");\nif ($refname == 'thumbs') {\n\t// If we get the thumbs directory, we must go one step higher. For example original_file='10/thumbs/myfile_small.jpg' -> refname='10'\n\t$refname = basename(dirname(dirname($original_file)).\"/\");\n}\n\n// Check that file is allowed for view with viewimage.php\nif (!empty($original_file) && !dolIsAllowedForPreview($original_file)) {\n\thttponly_accessforbidden('This file extension is not qualified for preview', 403);\n}","sourceCodeStart":245,"sourceCodeEnd":281,"githubUrl":"https://github.com/Dolibarr/dolibarr/blob/598aa4bdada683d17ca04b1842548821ff0eb6c6/htdocs/viewimage.php#L245-L281","documentation":"viewimage.php is an image/file wrapper; this guard fires when the requested file's resolved MIME type (from dol_mimetype or the 'type' parameter) contains 'html'. It blocks serving HTML through the image wrapper to prevent stored-XSS/phishing delivery of attacker-controlled HTML from the documents directory.","triggerScenarios":"Thrown at htdocs/viewimage.php:263 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Do not serve HTML files through viewimage.php; use the appropriate download endpoint (document.php) instead","Serve only genuine image MIME types through this wrapper","Rename or remove uploaded HTML files from the documents directory","Sanitize uploads at ingestion: reject or quarantine HTML/SVG-with-script content"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"598aa4bdada683d17ca04b1842548821ff0eb6c6","analyzedAt":"2026-09-14T11:12:15.309Z","contentChangedAt":"2026-09-14T11:12:15.309Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}