Uploaded image for project: 'CiviCRM'
  1. CiviCRM
  2. CRM-20468

Attachment.create API HTML escapes the uploaded content

          Details

          • Type: Bug
          • Status: Done/Fixed
          • Priority: Trivial
          • Resolution: Fixed/Completed
          • Affects Version/s: 4.7.18
          • Fix Version/s: 4.7.28
          • Component/s: None
          • Labels:
          • Versioning Impact:
            Patch (backwards-compatible bug fixes)
          • Documentation Required?:
            None
          • Funding Source:
            Needs Funding
          • Verified?:
            No

            Description

            When using the REST API to upload attachments using the Attachment.create API, the "content" field gets escaped by 'CRM_Utils_API_HTMLInputCoder'. This can result in corrupt file attachments if they happen to have a '<' character in them (ex: with a JPG, malicious cat photo attached).

             How to reproduce: c.f. attached python2 script.

              Attachments

              1. cat-photo.jpg
                205 kB
                Mathieu Lutfy
              2. test-civirest-api.py
                0.9 kB
                Mathieu Lutfy

                Activity

                  People

                  • Assignee:
                    Unassigned
                    Reporter:
                    mlutfy Mathieu Lutfy
                  • Votes:
                    0 Vote for this issue
                    Watchers:
                    2 Start watching this issue

                    Dates

                    • Created:
                      Updated:
                      Resolved: