Redmine

If I take a jpeg and run it through a file converter and save it back as a jpeg it seems to work. So it must be something to do with the internal metadata of the file not being correct, maybe the MIME security has been upgraded recently?

Thanks - I've done some of that already, will try your other suggestions also and report back - appreciated - thanks again!

SOLUTION - As Holger Just suggested, it was indeed a firewall issue, although it took a lot of time to find out exactly where that was happening, so will note here for the community in case anyone else gets the same.

ISSUE - certain files were getting a 403 (Forbidden) XHR error. So for one jpeg it would work, for another it would not. this happened immediately you selected the file, NOT when you hit submit. So I figured it was happening at the client side, either in the attachments.js code or else in the client firewalls (I run malwarebytes and windows firewall). Spent a long time looking at those, but the key was that if you open up the devtools (F12) and look at the error, it actually had additional info that the 403 was being returned by Cloudflare, not by my Laptop client.

Then took a while to track it down, and it was in a standard set of rules that Cloudflare runs, specifically "Cloudflare OWASP Core Ruleset". Now, to test whether it's that causing the problem is easy - just turn off the rule under Security>WAF>Managed Rules>Enabled>Off. So then immediately the problem jpeg file would upload ok. But I still really want those rules to operate, and in fact what happens is that cloudflare analyzes all files going through it, and in this case it activated 6 rules worth 5 points each for a threat level of 30. Well, the threshold is set to 25 by default, and so it was triggering and rejecting.

All I did to fix was to go to that rule>Edit>OWASP Anomaly Score Threshold>Change from 25 (High) to 40 (Medium). Still secure and would trigger for infected files, but a little less stringent so as to allow files through that might have various stuff like macros on a docx, or special characters in a PDF etc.

Again, thanks for your suggestion Holger, and hope anyone else getting this issue will be helped if they encounter something similar.

ADMIN - please CLOSE this issue, it is resolved.