Image upload issues after applying polyshell patch (Image not found + resize not working)

[milorad-smartweb]

First of all, thank you for this patch — it’s generally working well and has been very helpful.

However, I’ve encountered an issue related to product image handling after applying the patch.

Issue description

When images are assigned to products programmatically (e.g., via sync/import), the following problems occur:

1. Saving the product triggers an error:

   The image doesn't exist.
   

2. Image resize is not working:

   • Thumbnails are not generated

Expected behavior

• Images should be properly recognized after assignment
• Product save should not fail with "The image doesn't exist."
• Magento should generate resized images as usual

Observations

• The original image files exist in pub/media/catalog/product
• The issue only appears after applying this patch
• It appears that Magento is unable to properly resolve or process image paths during import or when the resize process is triggered via cron, as the file extension is not being preserved or recognized. Images uploaded manually through the admin work as expected.

Steps to reproduce

1. Apply the magento-polyshell-patch
2. Import or programmatically assign images to a product
3. Save the product via repository
4. Observe the "The image doesn't exist." error

Environment

• Magento version: 2.4.x (tested on 2.4.7-p9)
• PHP version: 8.3

Let me know if you need additional logs or debugging details.

[markshust]

Willing to take in a PR for whoever wants to tackle this 😄

[magenizr]

After checking a few things in the backend and testing some API calls in Postman, we decided to fully lock down custom_options for most of our clients so everyone can relax this weekend.

chmod -R 000 /var/www/html/shared/pub/media/custom_options

Note: The filesystem is read-only, except for the pub folder of course. So, that should do the job for a few days.

[aurel5542]

After checking a few things in the backend and testing some API calls in Postman, we decided to fully lock down custom_options for most of our clients so everyone can relax this weekend.

chmod -R 000 /var/www/html/shared/pub/media/custom_options

Note: The filesystem is read-only, except for the pub folder of course. So, that should do the job for a few days.

Hello, thanks for the tip! How to revert it when Adobe releases a isolated patch? And is it inteded that with this also .htaccess in the customs_options folder will be blocked? wouldnt it be enough to just block custom_options/quote folder?
Thank you and best regards!

[magenizr]

Hey @aurel5542

Yeah, you can just remove write permissions from custom_options/quote and monitor the folder. And if your server supports .htaccess, you can also block requests that way — that’s usually the better option.