TYPO3 Core

Disallowing PostScript files (PS, EPS, ...) was exactly the scope of the security fix in https://review.typo3.org/c/Packages/TYPO3.CMS/+/60700 since PS instructions would be directly executed by the according interpreter (GhostScript) when being invoked through ImageMagick.

The only thing I could think of is to have a possibility to weaken denied file extensions (like EPS) on a particular context and configured explicitly for a particular TYPO3 instance, e.g.

• allow EPS rendering in backend file list module
• still deny EPS rendering for file uploads in some frontend contact form

In case there are alternative suggestions please add them to this ticket. Thx

Oliver Hader wrote:

Disallowing PostScript files (PS, EPS, ...) was exactly the scope of the security fix in https://review.typo3.org/c/Packages/TYPO3.CMS/+/60700 since PS instructions would be directly executed by the according interpreter (GhostScript) when being invoked through ImageMagick.

The only thing I could think of is to have a possibility to weaken denied file extensions (like EPS) on a particular context and configured explicitly for a particular TYPO3 instance, e.g.

• allow EPS rendering in backend file list module
• still deny EPS rendering for file uploads in some frontend contact form

In case there are alternative suggestions please add them to this ticket. Thx

Hi Oliver, thanks for the answer!
And allow only EPS-Files Update without Thumbnail?
The Upload from EPS works fine, but maybe you can disable the Thumbnail-Image for the Error Message.

Thanks, Sebastian

Hi, we have the same Problem with the new x-eps Files.
In TYPO3 Version 8.x and 9.x
PHP 7.2

the Config dont help:
[GFX][imagefile_ext] = gif,jpg,jpeg,tif,tiff,bmp,pcx,tga,png,pdf,ai,eps,xeps,x-eps