diff --git a/modules/helpdesk/pages/helpdesk/ticket-file-data().php b/modules/helpdesk/pages/helpdesk/ticket-file-data().php index 55839ef..e4f54aa 100644 --- a/modules/helpdesk/pages/helpdesk/ticket-file-data().php +++ b/modules/helpdesk/pages/helpdesk/ticket-file-data().php @@ -79,7 +79,19 @@ if (strlen($data) > $maxFileSize) { return; } +// Ensure filename has an extension — derive from content if missing $displayFilename = $filename !== '' ? $filename : 'attachment-' . $entryNo; +if (!str_contains($displayFilename, '.')) { + $ext = match (true) { + str_starts_with($data, "\x89PNG") => '.png', + str_starts_with($data, "\xFF\xD8\xFF") => '.jpg', + str_starts_with($data, "GIF8") => '.gif', + str_starts_with($data, "%PDF") => '.pdf', + str_starts_with($data, "PK\x03\x04") => '.zip', + default => '', + }; + $displayFilename .= $ext; +} header('X-Content-Type-Options: nosniff'); header('Content-Security-Policy: sandbox');