Question

I have made a component in joomla in order to upload and save files as blob in the database.
The file seems to be getting uploaded normally, but when I try to download it I get an error:

7-Zip [64] 9.20 Copyright (c) 1999-2010 Igor Pavlov 2010-11-18
p7zip Version 9.20 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,8 CPUs)

Error: /tmp/payeddownloadsvisits-17.zip: Can not open file as archive

Errors: 1

This is what I have tried, in the view

<div id="dialog" title="Basic dialog" style="display:none;">    
   <form enctype="multipart/form-data" action="index.php?option=com_virtuemart&view=payeddownloads&task=uploadfile" method="post">
        <table>
            <tr><td>Product</td><td><select id="product" name="product"></td></tr>
            <tr><td>File</td><td><input name="file" type="file" id="file"/></td></tr>
            <tr><td></td><td><input name="upload" type="submit" id="upload" value=" Upload "></td></tr>
            <tr><td></td><td></td></tr>
        </table>
        <input type="hidden" name="MAX_FILE_SIZE" value="2000000">          

    </form>
    <progress style="display:none;" id="progress"></progress>   
</div>

this is the controler function

function uploadfile()
     {      
        $payeddownloadsModel = VmModel::getModel('payeddownloads');
        $payeddownloads = $payeddownloadsModel->uploadfile();

        JRequest::setVar('view', 'payeddownloads');
        JRequest::setVar('layout','default');        
        parent::display();                                      
     }

and this is the model function

public function uploadfile(){       
         $input = new Jinput;
         $virtuemart_product_id = $input->get('product');

         $fileName = $_FILES['file']['name'];
         $tmpName =  $_FILES['file']['tmp_name'];
         $fileSize = $_FILES['file']['size'];
         $fileType = $_FILES['file']['type'];
         $fp = fopen($tmpName, 'r');
         $content = fread($fp, filesize($tmpName));
         $content = addslashes($content);
         fclose($fp);

         if(!get_magic_quotes_gpc())
         {
         $fileName = addslashes($fileName);
         }


         $data =new stdClass();
         $data->id = null;
         $data->virtuemart_product_id = $virtuemart_product_id; 
         $data->file_size = $fileSize;
         $data->file_name = $fileName;
         $data->file_type = $fileType;
         $data->file_blob = $content;
         $data->reg_date = date("Y-m-d H:i:s");

         $db = JFactory::getDBO();
         $db->insertObject( '#__virtuemart_payeddownload_productfiles', $data, 'id' );

    }

The file is inserted in the table with the following structure

CREATE TABLE `ivf27_virtuemart_payeddownload_productfiles` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `virtuemart_product_id` varchar(45) DEFAULT NULL,
  `file_blob` blob,
  `file_size` varchar(45) DEFAULT NULL,
  `file_name` varchar(200) DEFAULT NULL,
  `file_type` varchar(45) DEFAULT NULL,
  `reg_date` datetime DEFAULT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=31 DEFAULT CHARSET=utf8$$

But when I try to download it:

public function getfile(){

        $jinput = JFactory::getApplication()->input;        
        $file_id = $jinput->get('file_id','','INT');        

        $sql = "select * from #__virtuemart_payeddownload_productfiles where id=$file_id";
        $db = JFactory::getDBO();       
        $db->setQuery($sql);
        $results = $db->loadObjectList();
        $file_size = $results[0]->file_size;
        $file_type = $results[0]->file_type;
        $file_name = $results[0]->file_name;
        $file_blob = $results[0]->file_blob;


        header('Content-Description: File Transfer');           
        header("Content-Type: $file_type");
        header("Content-Disposition: attachment; filename= $file_name");
        header('Expires: 0');
        header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
        header('Pragma: public');
        header('Content-Length: ' . strlen($file_blob));

        ob_clean();
        flush();

        echo $file_blob;
        exit;
    }

I get the following message from the browser:

7-Zip [64] 9.20  Copyright (c) 1999-2010 Igor Pavlov  2010-11-18
p7zip Version 9.20 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,8 CPUs)

Error: /tmp/payeddownloadsvisits-17.zip: Can not open file as archive

Errors: 1

But I made a test.php file outside the joomla framwork and uploaded the file again like this:

<?php         
 include("config.php");

 $fileName = $_FILES['userfile']['name'];
 $tmpName =  $_FILES['userfile']['tmp_name'];
 $fileSize = $_FILES['userfile']['size'];
 $fileType = $_FILES['userfile']['type'];
 $fp = fopen($tmpName, 'r');
 $content = fread($fp, filesize($tmpName));
 $content = addslashes($content);
 fclose($fp);

 if(!get_magic_quotes_gpc())
 {
 $fileName = addslashes($fileName);
 }

 $query = "INSERT INTO ivf27_virtuemart_payeddownload_productfiles set file_name='".$fileName."', file_size='".$fileSize."', file_type='".$fileType."', file_blob='".$content."'";        
 mysql_query($query) ;    
?>     

The file is uploaded successfully as expected + when I go back and download it from joomla I can open it – unzip it and read it normally.

So the problem occurs only when I upload the file from joomla 2.5 framework. I can download the file but I can’t unzip it.
If I upload the file from outside joomla, I can download the file normally and unzip it.

What is causing this and how can I fix it?

Answer 1

You’ve added slashes to the content before saving to the database, but you didn’t strip them after retrieving it. Stop using addslashes for security purposes, use the database functions, and you won’t break your own data