• karinthygesen

    (@karinthygesen)


    Recently users are getting an error when they try to upload profile picture on my website.

    The UI only says ERROR in red writing with no explanation. When checking the log I see that I get a 455 from the firewall on the admin-ajax.php.

    In simply.com control panel the rule blocking the request is “Malformed multipart body”.

    I don’t know if simply.com made changes to the firewall or something happened to the plugin. I have tried to disable other plugins, changing theme, rolling back to previous version etc. – nothing seems to be working.

    Could anyone help me please? 🙂

    Cheers

Viewing 12 replies - 1 through 12 (of 12 total)
  • Plugin Support Yurii

    (@yuriinalivaiko)

    Hello @karinthygesen

    Some firewall versions can not properly recognize a boundary in the multipart/form-data requests. See image1, image2.

    Try to change a version of the firewall module, or disable it for the multipart requests, or disable it for the AJAX route /wp-admin/admin-ajax.php

    Regards

    Thread Starter karinthygesen

    (@karinthygesen)

    Hi @yuriinalivaiko

    Thank you for your reply 🙂

    I don’t get as far as the images you have sent – I am being stopped here – sorry it is in Danish 🙂

    I don’t seem to have access to changing or disabling parts of the firewall at simply.com so I am not able to try that, sorry.

    But I have created a ticket at simply.com – they seem to believe it is related to missing User Agent in the request.

    Regards

    Hello @karinthygesen and @yuriinalivaiko

    We are having the exact same problem with our site, also with simply.com as the provider.
    Seems to have started a few days ago. It’s also an error 455 from admin-ajax.php, when trying to upload anything.
    I’ve been in touch with simply.com over the past few days and they replied with “Malformed multipart body” and that it seems to be an issue with the plugin Ultimate Member.
    Sadly I have nothing further to add, but really hoping for a solution, as this hinders our work significantly.

    Good day to the both of you! 🙂

    @karinthygesen
    @emiloe

    Which PHP versions are you using at your web hosting provider?
    Do you have the option to change PHP version?

    Thread Starter karinthygesen

    (@karinthygesen)

    Hi @missveronicatv

    I am currently using 8.5. I just tried to change it to 8.4. It doesn’t solve the issue unfortunately.

    Regards

    @karinthygesen

    I made a search and found CVE-2024-8925
    which was “erroneous parsing of multipart form data”
    in early versions of PHP 8.1, 8.2 and 8.3

    Thread Starter karinthygesen

    (@karinthygesen)

    Ok then we have ruled that out 🙂

    Thanks for the try @missveronicatv

    missveronica

    (@missveronicatv)

    @karinthygesen

    Are you using the UM plugin Extension for
    “Profile photo upload in Register and Account forms”?

    The Profile photo upload from the Account page is not supported any more by UM.

    https://ultimatemember.github.io/docs-v3/extended/article/1671-enable-profile-photo-uploader-in-register-and-account-forms.html

    • This reply was modified 4 days, 9 hours ago by missveronica.
    Plugin Support Yurii

    (@yuriinalivaiko)

    Hello @karinthygesen

    Images that I have sent are the same as yours but without an error. I’ve attached images to clarify what a boundary is in a multipart request. Boundaries are valid in our request, but some firewalls may not recognize it. This issue isn’t related to other plugins. It’s a problem with the firewall configuration.

    Regards

    Thread Starter karinthygesen

    (@karinthygesen)

    Hi @yuriinalivaiko

    I got a reply from simply.com:

    It’s a bug in the plugin

    Ultimate Member uses an upload library (jquery.uploadfile.js), which adds an extra, empty field to the request for every upload. The field has no name and contains the text undefined:

    ——WebKitFormBoundaryXXXX
    Content-Disposition: form-data; name=””

    undefined
    ——WebKitFormBoundaryXXXX–

    The bug occurs in the library’s serializeData(): dynamicFormData returns an empty object {} by default, which is serialized to an empty text string, and the result is a field with an empty name and the value undefined. This happens on every upload, regardless of browser and file type.

    @karinthygesen

    Yes that’s right, there is an empty field undefined by the end of the upload.

    You can try this code snippet, which will remove the undefined with empty name.
    I have tested this code snippet at my site even if the bad undefined is ignored by my hosting server and with the code snippet active the upload looks clean.

    add_action('wp_footer', function() { ?>
        <script type="text/javascript">
        (function() {
            var originalAppend = FormData.prototype.append;
            FormData.prototype.append = function(name, value, filename) {
                if (!name || name === 'undefined' || value === 'undefined') {
                    return;
                }
                if (arguments.length === 3) {
                    originalAppend.call(this, name, value, filename);
                } else {
                    originalAppend.call(this, name, value);
                }
            };
        })();
        </script>
        <?php
    });

    You install the code snippet by adding it to your active theme’s functions.php file or use the “Code Snippets” Plugin

    https://wordpress.org/plugins/code-snippets/

    Plugin Support Yurii

    (@yuriinalivaiko)

    Thank you @karinthygesen and @missveronicatv

    I asked a lead developer to update or replace the “jQuery Upload File plugin” library. Although an empty field is not an error for HTTP, it is better to get rid of it to avoid such conflicts.

    As a temporary solution you may try update this library manually. Download the latest version from GitHub and replace these files:
    – /assets/libs/fileupload/jquery.uploadfile.js
    – /assets/libs/fileupload/jquery.uploadfile.min.js

    • This reply was modified 2 days, 18 hours ago by Yurii.
Viewing 12 replies - 1 through 12 (of 12 total)

You must be logged in to reply to this topic.