Kunena 7.0.9 & Kunena 6.4.14 – Security Updates Released

The Kunena team has announce the arrival of Kunena 7.0.9 [K 7.0.9] in stable which is now available for download as a native Joomla extension for J! 5.4.x/6.0.x./6.1.x. This version addresses most of the issues that were discovered in K 6.2 / K 6.3 / K 6.4 and issues discovered during the last development stages of K 7.0

Question Display of PDFs in messages stopped working

More
1 day 14 hours ago - 19 hours 40 minutes ago #235406 by btc
I started this thread six weeks ago with the title Is it possible to revert from K7.0.8 to K6.4? and  9themestore  got involved. However, because of being very busy with some urgent matters I wasn't able to take up his offer and haven't been able to work on this further until today.

The thread title is in fact misleading, the real issue was that after I moved from K6.4 to K7.0, the display of PDFs in messages stopped working - both when using a 9themstore template and when using the default template.. I've now found a workround that works:

Instead of using the full path to the PDF file I edited template/system/layouts/bbcode/attachment/pdf.php to use a relative link and now everything works properly.

After line 21 I added $location = substr($location,21); to remove the first part of the URL - in my case this removes https://www,pgweb.uk/ - which is 21 characters long. 

I wonder whether the cause could be some hardening of security by the developers of Joomla or one of the extensions that I use? But why have other users not encounterd this issue?

The solution that I found is not of course applicable across the board because it depends on the number of characters in the base URL for each specific website.
Edit Pinkeltje: I've changed the topic subject.
 
Last edit: 19 hours 40 minutes ago by Pinkeltje.

Please Log in or Create an account to join the conversation.

More
22 hours 44 minutes ago - 22 hours 41 minutes ago #235410 by xillibit
Hello,

In your case you have setting attachment protected disabled, so this issue could be caused by SEF settings.
The method which generate URL for pdf embeded in message is here :  github.com/Kunena/Kunena-Forum/blob/K6.4...aAttachment.php#L584

Do-you use the htaccess without changes in it or there is changes in it ?

I don't provide support by PM, because this can be useful for someone else.
Last edit: 22 hours 41 minutes ago by xillibit.

Please Log in or Create an account to join the conversation.

More
22 hours 14 minutes ago - 22 hours 12 minutes ago #235412 by Pinkeltje
I've looked into this. The PDF part of Kunena hasn't changed between K6.4 and K7.0: pdf.php and the getUrl() method in KunenaAttachment work the same way in both versions. So this isn't caused by Kunena 7 itself.
I checked the direct URL of one of your PDFs (/media/kunena/attachments/773/20260709_075242.pdf): it returns 200 OK with Content-Type: application/pdf, so the .htaccess doesn't seem to block the file itself.

A few things I noticed on your site:
  1. Your attachments aren't protected (the PDF has its normal filename), so that setting isn't the issue.
  2. The PDF is served correctly by your server (Content-Type: application/pdf, same origin, www redirect is fine).
  3. The wf-responsive classes and the ?ts= parameter on your <object> come from the Responsify plugin (by the JCE developers), not from Kunena. I tested Responsify on my own test site, though, and the PDF still displayed fine there.

Could you please:
  1. Restore the original pdf.php (remove your substr change)
  2. Clear the JCH Optimize cache and do a hard refresh (Ctrl+F5)
  3. If the PDF still doesn't show, open the browser console (F12) and post any error messages here, together with the rendered <object> line from the page source.

That way we can see what is actually blocking it on your site.
Last edit: 22 hours 12 minutes ago by Pinkeltje.

Please Log in or Create an account to join the conversation.

Time to create page: 0.251 seconds