Repository navigation
Fix/upload active content scan - #694
Merged
Merged
Conversation
… pick time Supersedes #676 on top of #690. `MediaContent::activeContentReason()` now covers .docx/.pptx (vbaProject.bin part), legacy .doc/.ppt (VBA stream) and RTF (\objupdate, \objautlink) beside the existing PDF markers, using the same head/tail windowed read so a large upload never lands in memory whole. `FileOrImageValidValue` reports the reason in the validation message. A new `admin.media.scan` endpoint runs the same rule on a file the moment the media widget picks it; the three widgets share one `$scanMedia` helper in app.js and only treat a 422 as a rejection, since form validation stays the enforcement point. Claude-Session: https://claude.ai/code/session_01JvM9wYbv339YvEnEuvsKrT
… pick time Supersedes #676 on top of #690. `MediaContent::activeContentReason()` now covers .docx/.pptx (vbaProject.bin part), legacy .doc/.ppt (VBA stream) and RTF (\objupdate, \objautlink) beside the existing PDF markers, using the same head/tail windowed read so a large upload never lands in memory whole. `FileOrImageValidValue` reports the reason in the validation message. A new `admin.media.scan` endpoint runs the same rule on a file the moment the media widget picks it; the three widgets share one `$scanMedia` helper in app.js and only treat a 422 as a rejection, since form validation stays the enforcement point. Claude-Session: https://claude.ai/code/session_01JvM9wYbv339YvEnEuvsKrT
Copilot started reviewing on behalf of
navneetkumar-pim-webkul
September 10, 2026 08:45
View session
There was a problem hiding this comment.
🟡 Changes recommended
Two confirmed bugs can cause false negatives in tail scanning and false 422 rejections when accepted extensions include leading dots.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR extends UnoPim’s upload “active content” protections beyond PDFs to additional document formats (OOXML, legacy Office, RTF), and adds a pick-time (pre-submit) scan endpoint + UI integration so admins get immediate feedback when selecting a blocked file.
Changes:
- Added
MediaContent::activeContentReason()and extended scanning to detect VBA macros (OOXML + legacy OLE) and auto-executing RTF OLE objects. - Updated upload validation (
FileOrImageValidValue) to reject files with active content and report a localized reason. - Added an authenticated
admin.media.scanendpoint plus client-side$scanMedia()and wired it into media picker components.
File summaries
| File | Description |
|---|---|
| public/themes/admin/default/build/manifest.json | Updates built asset manifest references after rebuilding admin assets. |
| public/themes/admin/default/build/assets/vendor-DBf-FxXK.js | Removes old hashed vendor bundle from build output. |
| public/themes/admin/default/build/assets/vendor-Cy61opEo.js | Adds new hashed vendor bundle from build output. |
| public/themes/admin/default/build/assets/veeValidate-BW9dJRnn.js | Updates vee-validate bundle import to new Vue hash. |
| packages/Webkul/Core/tests/Unit/MediaContentActiveContentTest.php | Adds unit coverage for active-content detection across formats. |
| packages/Webkul/Core/tests/Unit/FileOrImageValidValueSecurityTest.php | Adds security-focused validation tests for rejected uploads and messages. |
| packages/Webkul/Core/src/Rules/FileOrImageValidValue.php | Switches from PDF-only detection to generalized active-content detection with reason. |
| packages/Webkul/Core/src/Resources/lang/ar_AE/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/ca_ES/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/da_DK/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/de_DE/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/en_AU/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/en_GB/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/en_NZ/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/en_US/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/es_ES/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/es_VE/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/fi_FI/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/fr_FR/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/hi_IN/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/hr_HR/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/id_ID/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/it_IT/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/ja_JP/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/ko_KR/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/mn_MN/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/nl_NL/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/no_NO/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/pl_PL/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/pt_BR/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/pt_PT/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/ro_RO/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/ru_RU/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/sv_SE/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/tl_PH/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/tr_TR/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/uk_UA/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/vi_VN/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/zh_CN/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Resources/lang/zh_TW/validation.php | Adds new validation message + reason translations. |
| packages/Webkul/Core/src/Helpers/MediaContent.php | Implements multi-format active-content detection and OOXML macro scanning. |
| packages/Webkul/Admin/tests/Feature/MediaScanTest.php | Adds feature tests for the new pick-time scan endpoint. |
| packages/Webkul/Admin/src/Routes/rest-routes.php | Registers POST admin/media/scan. |
| packages/Webkul/Admin/src/Resources/views/components/media/image.blade.php | Adds pick-time scan before accepting selected/replaced images. |
| packages/Webkul/Admin/src/Resources/views/components/media/gallery.blade.php | Adds pick-time scan before accepting selected/replaced gallery items. |
| packages/Webkul/Admin/src/Resources/views/components/media/files.blade.php | Adds pick-time scan before accepting selected/replaced files. |
| packages/Webkul/Admin/src/Resources/assets/js/app.js | Adds global $scanMedia() helper used by media components. |
| packages/Webkul/Admin/src/Http/Requests/MediaScanRequest.php | Adds request validation for scan endpoint inputs. |
| packages/Webkul/Admin/src/Http/Controllers/MediaController.php | Implements scan endpoint returning {valid, message} JSON. |
| CHANGELOG.md | Documents the new scanning behavior and pick-time feedback. |
Review details
- Files reviewed: 49/56 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue Reference
Description
How To Test This?
Screenshots
Checklist
vendor/bin/pestpasses locallyvendor/bin/pint --testreports no style issues3.x, the current release line (mastertargets the next major)Documentation