When attempting to upload a new banner image from the Cachet 3 dashboard, the upload fails with:
The banner image field contains a file path that is not permitted
The image is a valid supported image type and the upload reaches the Livewire temporary upload stage successfully, but the Cachet settings form subsequently rejects the file.
Environment
Cachet: cachethq/core dev-main
Commit: 5ee03e6
Filament Forms: v5.7.6
Livewire: v4.4.2
Steps to reproduce
Log into the Cachet 3 administration dashboard.
Navigate to the theme/settings page.
Select a new banner image.
Save the settings.
The form returns:
The banner image field contains a file path that is not permitted
Cause
The app_banner field in:
src/Filament/Pages/Settings/ManageTheme.php
currently uses:
FileUpload::make('app_banner')
->acceptedFileTypes((array) config('cachet.uploads.image_mime_types'))
->maxSize((int) config('cachet.uploads.max_size'))
->preventFilePathTampering()
The issue appears to be related to preventFilePathTampering().
Filament's validation checks submitted string file paths against the original path associated with the record. With a newly uploaded banner, the resulting path does not match the existing/original app_banner value, resulting in the upload being rejected as an unauthorised file path.
Workaround
Removing:
->preventFilePathTampering()
from the app_banner FileUpload definition allows the banner to upload successfully.
The resulting configuration is:
FileUpload::make('app_banner')
->acceptedFileTypes((array) config('cachet.uploads.image_mime_types'))
->maxSize((int) config('cachet.uploads.max_size'))
->imageEditor()
->label(('cachet::settings.manage_theme.app_banner_label'))
->hiddenLabel()
->helperText(('cachet::settings.manage_theme.app_banner_helper'))
->disk((string) config('cachet.uploads.disk'))
->columnSpanFull()
Expected behaviour
A valid supported image should be accepted as the new banner image and saved successfully.
Actual behaviour
The upload fails validation with:
The banner image field contains a file path that is not permitted
Suggested investigation
Please investigate the use of:
->preventFilePathTampering()
on the app_banner field and its interaction with the current Filament/Livewire versions.
Removing this option resolves the issue, suggesting that the banner upload is being incorrectly treated as an unauthorised existing file path rather than a legitimate newly uploaded file.
This may be a Cachet/Filament/Livewire compatibility issue rather than an issue with the uploaded image itself.
When attempting to upload a new banner image from the Cachet 3 dashboard, the upload fails with:
The banner image field contains a file path that is not permitted
The image is a valid supported image type and the upload reaches the Livewire temporary upload stage successfully, but the Cachet settings form subsequently rejects the file.
Environment
Cachet: cachethq/core dev-main
Commit: 5ee03e6
Filament Forms: v5.7.6
Livewire: v4.4.2
Steps to reproduce
Log into the Cachet 3 administration dashboard.
Navigate to the theme/settings page.
Select a new banner image.
Save the settings.
The form returns:
The banner image field contains a file path that is not permitted
Cause
The app_banner field in:
src/Filament/Pages/Settings/ManageTheme.php
currently uses:
FileUpload::make('app_banner')
->acceptedFileTypes((array) config('cachet.uploads.image_mime_types'))
->maxSize((int) config('cachet.uploads.max_size'))
->preventFilePathTampering()
The issue appears to be related to preventFilePathTampering().
Filament's validation checks submitted string file paths against the original path associated with the record. With a newly uploaded banner, the resulting path does not match the existing/original app_banner value, resulting in the upload being rejected as an unauthorised file path.
Workaround
Removing:
->preventFilePathTampering()
from the app_banner FileUpload definition allows the banner to upload successfully.
The resulting configuration is:
FileUpload::make('app_banner')
->acceptedFileTypes((array) config('cachet.uploads.image_mime_types'))
->maxSize((int) config('cachet.uploads.max_size'))
->imageEditor()
->label(('cachet::settings.manage_theme.app_banner_label'))
->hiddenLabel()
->helperText(('cachet::settings.manage_theme.app_banner_helper'))
->disk((string) config('cachet.uploads.disk'))
->columnSpanFull()
Expected behaviour
A valid supported image should be accepted as the new banner image and saved successfully.
Actual behaviour
The upload fails validation with:
The banner image field contains a file path that is not permitted
Suggested investigation
Please investigate the use of:
->preventFilePathTampering()
on the app_banner field and its interaction with the current Filament/Livewire versions.
Removing this option resolves the issue, suggesting that the banner upload is being incorrectly treated as an unauthorised existing file path rather than a legitimate newly uploaded file.
This may be a Cachet/Filament/Livewire compatibility issue rather than an issue with the uploaded image itself.