Banner image upload fails with "The banner image field contains a file path that is not permitted"
- Dominant language
- PHP
- Stars
- 227
- Forks
- 84
- Avg merge
- 11h 14m
- Merged PRs (30d)
- 24
Description
When attempting to upload a new banner image from the Cachet 3 dashboard, the upload fails with:
The banner image field contains a file path that is not permitted
The image is a valid supported image type and the upload reaches the Livewire temporary upload stage successfully, but the Cachet settings form subsequently rejects the file.
Environment
Cachet: cachethq/core dev-main
Commit: 5ee03e64e7ecc7eae085b05cce4740477da91954
Filament Forms: v5.7.6
Livewire: v4.4.2
Steps to reproduce
Log into the Cachet 3 administration dashboard.
Navigate to the theme/settings page.
Select a new banner image.
Save the settings.
The form returns:
The banner image field contains a file path that is not permitted
Cause
The app_banner field in:
src/Filament/Pages/Settings/ManageTheme.php
currently uses:
FileUpload::make('app_banner')
->acceptedFileTypes((array) config('cachet.uploads.image_mime_types'))
->maxSize((int) config('cachet.uploads.max_size'))
->preventFilePathTampering()
The issue appears to be related to preventFilePathTampering().
Filament's validation checks submitted string file paths against the original path associated with the record. With a newly uploaded banner, the resulting path does not match the existing/original app_banner value, resulting in the upload being rejected as an unauthorised file path.
Workaround
Removing:
->preventFilePathTampering()
from the app_banner FileUpload definition allows the banner to upload successfully.
The resulting configuration is:
FileUpload::make('app_banner')
->acceptedFileTypes((array) config('cachet.uploads.image_mime_types'))
->maxSize((int) config('cachet.uploads.max_size'))
->imageEditor()
->label(__('cachet::settings.manage_theme.app_banner_label'))
->hiddenLabel()
->helperText(__('cachet::settings.manage_theme.app_banner_helper'))
->disk((string) config('cachet.uploads.disk'))
->columnSpanFull()
Expected behaviour
A valid supported image should be accepted as the new banner image and saved successfully.
Actual behaviour
The upload fails validation with:
The banner image field contains a file path that is not permitted
Suggested investigation
Please investigate the use of:
->preventFilePathTampering()
on the app_banner field and its interaction with the current Filament/Livewire versions.
Removing this option resolves the issue, suggesting that the banner upload is being incorrectly treated as an unauthorised existing file path rather than a legitimate newly uploaded file.
This may be a Cachet/Filament/Livewire compatibility issue rather than an issue with the uploaded image itself.
Contributor guide
Research direction
Start in src/Filament/Pages/Settings/ManageTheme.php and inspect the app_banner FileUpload definition, especially preventFilePathTampering(), alongside the current Filament and Livewire versions. Reproduce the dashboard upload, compare behavior with that option removed, and confirm that a valid supported banner image is accepted and saved without the file-path validation error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- laravel, php
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 82/100