Can't upload .exe / .msg files, can everything else

0
votes

I'm running the following environment:

  • PHP 7.1.7
  • IIS 10
  • Windows 10 1703
  • Laravel 5.4.30

Here's my upload script (really simple, accepts all uploads):

public function uploadToTemporary(AttachmentUploadRequest $request)
{
    /** @var \Illuminate\Http\UploadedFile $file */
    $file = $request->file('file');

    return [
        'name' => $file->getClientOriginalName(),
        'location' => $file->store('temporary'),
    ];
}

My AttachmentUploadRequest rules:

public function rules()
{
    return [
        'file' => 'file|max:20000',
    ];
}

When I upload files with the extensions .msg, .exe, I receive:

(1/1) ErrorException fopen(C:\Users\Steve\Websites\tickets\storage\app\temporary/V4WslICBUK3TjK9Cn46nmKkXxtJVAGfDkxJiN9Lg.): failed to open stream: Permission denied

The thing is, I can upload every other type of file successfully. Here's the file extensions that upload successfully without any permission issues:

  • .docx, .doc
  • .pptx, .ppt
  • .xlsx, .xls
  • .txt
  • .mp4, .avi, .mp3
  • .pdf
  • .vrd
  • .jpg, .gif, .bmp

Does anyone know why this would happen?

EDIT: I verified that the files are being saved successfully in the temporary windows location by downloading a 1.1mb executable and uploading it:

enter image description here

1
phplaravel
Are you running mod_security by any chance? If so - check SecRule directive – eithed
I'm not aware of a mod_security extension. By googling, looks like an Apache module? I don't have it configured, that's for sure. – Steve Bauman
The server maybe running DLP. What about changing the extension from say an .exe to ,rename? If you rename to a different extension, the web server should accept your exe file. – Leptonator
Yup, it's a module to Apache that scans the files and prevents them from being uploaded in the first place resulting in 500 error. It also works on a signature basis, so changing extension doesn't work, but seeing that the file is being placed on the server that's not it (and the issue is within PHP). Can you by any chance do what @Leptonator suggested? – eithed
@Leptonator, unfortunately I receive the same exception by renaming the .exe to .rename or any other. So bizarre! – Steve Bauman

1 Answers

0
votes

Maybe some antivirus protection is blocking the action. Try disabling it temporarily.