From f40b23d2b09fc44b3cb3401b015818554fa887fe Mon Sep 17 00:00:00 2001 From: fs Date: Sun, 5 Apr 2026 22:58:12 +0200 Subject: [PATCH] fix(helpdesk): detect file extension from magic bytes when filename has none OData TicketLog doesn't expose the original filename (DataText field). When the derived filename has no extension, detect the file type from magic bytes (PNG, JPEG, GIF, PDF, ZIP) and append the correct extension. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../helpdesk/pages/helpdesk/ticket-file-data().php | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/modules/helpdesk/pages/helpdesk/ticket-file-data().php b/modules/helpdesk/pages/helpdesk/ticket-file-data().php index 55839ef..e4f54aa 100644 --- a/modules/helpdesk/pages/helpdesk/ticket-file-data().php +++ b/modules/helpdesk/pages/helpdesk/ticket-file-data().php @@ -79,7 +79,19 @@ if (strlen($data) > $maxFileSize) { return; } +// Ensure filename has an extension — derive from content if missing $displayFilename = $filename !== '' ? $filename : 'attachment-' . $entryNo; +if (!str_contains($displayFilename, '.')) { + $ext = match (true) { + str_starts_with($data, "\x89PNG") => '.png', + str_starts_with($data, "\xFF\xD8\xFF") => '.jpg', + str_starts_with($data, "GIF8") => '.gif', + str_starts_with($data, "%PDF") => '.pdf', + str_starts_with($data, "PK\x03\x04") => '.zip', + default => '', + }; + $displayFilename .= $ext; +} header('X-Content-Type-Options: nosniff'); header('Content-Security-Policy: sandbox');