When to add NIcepage as an exception

Hi azurelinksc,

Thanks for sending the file and the log details — that's very helpful.

I've reviewed FormProcessor.php in full. You were right — it's a legitimate file: Nicepage's own form-processing logic plus a bundled, unmodified copy of PHPMailer.

This is exactly the kind of case the "reviewed" feature in the next version is meant for: legitimate, but worth re-checking if the file ever changes, rather than a permanent blind spot. So instead of a plain exception, mark it as reviewed once that's available — the alert will stay quiet as long as the file's hash doesn't change, and it'll automatically reappear if it's ever modified. That way if someone did manage to tamper with it later, you'd still get flagged.

On the two XSS log entries (the <head> content and the "back to top" SVG button on saveSiteSettings): those line up with what I expected — Nicepage saves raw HTML/CSS/SVG as part of its site settings, and the filter strips/flags that as a precaution. Since you've already excluded com_nicepage from XSS and Second Level, those specific ones should stay resolved.

On the IMG_2495.JPG upload block: I've made some recent changes to the file scanner, and this is most likely a false positive from those.

If it happens again, could you send me the original file? Quite often applications embed code inside images (in EXIF or other metadata, for example), which can trigger the scanner even though the image itself is legitimate — I'd like to check the actual file to confirm that's what's happening here.

Regards,
Jose

Hola Jose,
Okay, uploading two image files privately for your review.
 

Hi azurelinksc,

I've reviewed both files and they are legitimate images — there's nothing malicious in them. I'm not able to determine exactly why the upload scanner flagged them as containing PHP/script content, because reproducing the upload requires going through NicePage's own editor, which now forces a Google/Facebook account registration to access — something I'm not willing to do just to debug this.

What I can tell you is that uploading the very same files through Joomla's native Media Manager works fine and doesn't trigger any block, so the files themselves are clean. My best guess is that NicePage's uploader modifies the file in some way before sending it that causes the false positive, but I can't confirm the exact cause without that reproduction step.

Regards,
Jose