File upload error

According to Gravity Forms, they do not consider their plugin to be compatible at this time. WordPress doesn’t recommend it yet either. Wordfence is compatible and we have tested using it. What might cause issues is other plugins or themes that are not compatible and have a conflict with Wordfence as a result. Our recommendation is to use a supported version of PHP until WordPress and Gravity Forms complete their compatibility fixes.

Please see the links below for more information:

https://docs.gravityforms.com/gravity-forms-and-php-8-0-compatibility/
https://make.www.ads-software.com/core/2020/11/23/wordpress-and-php-8-0/

I hope this helps

Tim

• This reply was modified 2 years, 10 months ago by WFSupport. Reason: clarity

I shared your above response with gravity forms. This was their response:

You have confirmed that enabling Wordfence makes the issue appear and disabling Wordfence resolves the issue, so there’s no issue with your PHP version, it’s working without issues with the same PHP version when Wordfence is disabled, so it’s clearly something that Wordfence needs to investigate and fix.

I also deactivated all plugins to narrow down the issue and to make sure nothing is conflicting. It only happens when wordfence is active and under the conditions, I described in my initial statement.

Can you please advise of a fix?

Hi @empirecell012,

Tim asked me to take a look at this issue. Can you check Wordfence’s Live Traffic page, to see if a blocked hit appears at the time when this issue happens? Also, what kind of files are being uploaded, and are they being uploaded by users who don’t need to log in?

I’m not sure what the Gravity Forms errors Error: -200 and Message: HTTP Error. mean. (I’m assuming the -200 is an internal code, so it’s possible this could be a 403 error caused by blocking.)

If you see hits blocked for “Malicious File Upload (PHP)” in Live Traffic when an upload fails, try turning off only that rule on the Manage Firewall page. (It appears under “Advanced Firewall Options” in the “Rules” section. You may need to click “Show All Rules” at the bottom of the short list of rules.)

We have multiple WAF rules to prevent malicious file uploads, so it may be necessary to turn off only this one to prevent false positives. This rule prevents anything that could be treated as code by PHP, and PHP 8 is a bit more flexible in what it will allow than 7.x versions.

-Matt R

a blocked hit does not appear under the live traffic.
the files being uploaded are pdf documents.
the files are being uploaded by users and they DO NOT need to log in.

I see the long list of rules, but I have no idea which one to turn off.

Can you advise further?

Thank you

Thanks for the additional details. The rule to try turning off is the same name as the one to check for in Live Traffic, Malicious File Upload (PHP), sorry that wasn’t clear!

If that does help, could you also send us a copy of a PDF that couldn’t be uploaded? Not all PDFs should be affected, so this may help narrow down what can be safely allowed. You can email it to wftest @ wordfence . com and just include your username in the subject line and a link to this post in the body, so I can find it.

(If the PDFs contain any sensitive or personal information, don’t send any — we can try to reproduce the issue without a sample, if that is the case.)

-Matt R

These are not special document types. a blank 1-page pdf would have spit the same error “Error: -200 and Message: HTTP Error”.

Malicious File Upload (PHP), was the issue. I turned it off and everything works fine now.

Do you think this will be fixed in a future update?

Please advise.

Thank you

Thanks for confirming. Yes, we will be looking at options to keep this “strict enough”, while reducing false positives in a future Wordfence version — it’s a bit harder to balance because PHP 8.0+ is fairly lax on what it will parse without error, despite other parts of the language becoming more strict.

I have a variety of PDFs from different sources that can be uploaded without being blocked, so if you have a chance to send a copy of the blank page PDF, we can still add this to our tests for the future. It’s possible that PDFs created by certain tools or libraries are formatted differently internally.

-Matt R
Wordfence QA Lead

I have the same issue on https://www.agganis.com/, Gravity forms was working fine until the PHP was upgraded to 8.

Then forms with file upload where blocked by Wordfence – I have a screen shot of the message from Wordfence if it is of use to you.

There were a couple of wrinkles though – Administrators on the site were NOT blocked even if they were not logged in, only customers were blocked from uploading files (Jpegs and PDFs) – this made it difficult for the site owner since they were getting dozens of calls from customers on an error they could not reproduce.

The site owner was finally able to reproduce the problem on her son’s computer!

Also there was something weird happening on the block list – there was no list! according to Wordfence nothing was being blocked.

Switching PHP back to 7.4 eliminated the problem.

Colin

Hi guys,

wanted to +1, as I have the very same issue as of today as described above, but with Contact Form 7 plugin that uploading files.
After a looong investigation I have found out the rule “Malicious File Upload (PHP)” is causing the issue; despite the files uploaded are PDF`s (for me other file types are OK including images). Would have been easier if I found this thread first, meh ??

So in my experience, WF was correctly adding the exception to the CF7 callback during learning mode, but after switching to protection mode the api calls for anonyms users like /wp-json/contact-form-7/v1/contact-forms/4668/feedback are all giving http 403, without any sign/entry in live traffic view, or any log entry in WP logs. Pretty frustrating as you can guess, so until a long term fix it would be great to have at least a log entry when WF finds a file malicious .

In my case it is not possible to switch back to pre 8 version of PHP, so my question if there is any suggestion apart form turning off this rule?

Thanks,
Roland

+1 on this issue, encountered the same with all PDF file uploads and PHP 8.1. No entry in live traffic log, reverting to php 7.4 fixed the issue. I am running multi-site, and this does NOT occur when logged in as super-admin (perhaps those permissions allow all actions from WF).

• This reply was modified 2 years, 6 months ago by jcutler.