Skip to main content
NorrNext Anniversary. We've been around for 10 years! Celebrate with us and get a 20% discount. Coupon code: ANNIVERSARY10

#190 Frontend Multi-Upload Bug – Homepage Injected & Dropzone Error

Posted in ‘NorrCompetition’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information (available for public)

PHP version
8.1 and tried 8.2 joomla 5 cPanel Built on AlmaLinux 9

Latest post by b2z on Monday, 15 September 2025 11:03 EEST

strokesavvy

Environment:

My website is adult orientated but, safe for work

Joomla 5 (clean install tested) PHP 8.1 cPanel
Built on AlmaLinux 9

 

Norr (latest version, clean install tested)
Default Cassiopeia template (no overrides)
Steps to reproduce:

Log in as a frontend user with permission to add entries.
From the main menu → Norr → Add Entry, open the Add Entry form.
Fill in the entry fields.
Use the multi-upload option to upload several images.
Observed behavior:

All images upload and process correctly (previews show as expected).
Immediately after, the full homepage (index.php output) is injected into the upload container.
This corrupts the form DOM and the Save/Submit button stops working.
Console output below

 

Notes:

Single image upload works fine (frontend and backend).
Backend entry creation works fine with multi-upload.
Issue occurs only on frontend multi-upload.
Reproduced on clean Joomla + clean Norr install with default Cassiopeia index.php.
Tested with cookies, SEF, secret rotation, and stripped homepage → same result.
Expected behaviour:

Multi-upload should only return the image previews and controls.
No homepage output should be appended.
Dropzone should complete without errors and the form should remain valid.

Norr is a vital ingredient to my website, without it the rest wont work so please if you can, get this to work for me. I had this problem before but for some reason the switch to GD worked at the time but no longer does, besides, ImageMagick is better for me.

 

I will hope and thank you in anticipation, your app is superb and I adore it he he

 

Kevin Griffiths (strokesavvy)

dropzone.min.js?5.9.3:1 Uncaught TypeError: Cannot read properties of null (reading 'remove')
    at i.<anonymous> (<anonymous>:19:63)
    at i.value (dropzone.min.js?5.9.3:1:68333)
    at i.value (dropzone.min.js?5.9.3:1:95822)
    at HTMLAnchorElement.l (dropzone.min.js?5.9.3:1:77722)

b2z

Hi Kevin!

Installed version 2.0.10-dev with a fix. Submitted one entry with success.

I noticed that you do not have a a menu item for the list of contests. Please create one (could be hidden), it will correctly route the contests without menu items assigned.

Kind regards,

Dmitrijs

strokesavvy

Oh wow I dont know what to say, thanks is the understatement of the year! I love this app. If you have somewhere for me to write how fast the support has been here please send me a link. You have literally saved my bacon

 

Cheers man 👍

b2z

Thank you :) We would be grateful if you can leave a review:

Kind regards,

Dmitrijs

strokesavvy

Both locations now have a new review

 

Kev 

b2z

Thank you!

Kind regards,

Dmitrijs

strokesavvy

Hello Dmitrijs,

I’ve tested the latest build and found a consistent issue:

Server limits are generous: upload_max_filesize = 2G, post_max_size = 3G, max_file_uploads = 50.
Single upload fields work fine (main image uploads no problem).
The gallery multi-upload field fails completely — even if I upload just 1 file.
Same behaviour on frontend and backend.
Custom fields and cookie plugin disabled for testing → no effect.
Looks like the gallery uploader isn’t handing anything to PHP at all.

Can you check the multi-upload handler? At the moment, it’s impossible to add gallery photos.

Thanks again — I know this is the third round, but you’ve been great at fixing things so far.

The login details are the same as the previous entries here

Best,
Kev

b2z

Hi Kevin,

Please open your website or provide user and pass. Cannot proceed.

Kind regards,

Dmitrijs

strokesavvy

Oh I am sorry, you should have access now,

 

Regards

Kev

b2z

There is a 502 Bad Gateway response from the server.

===

General

Request URL:
index.php?option=com_competition&task=ajaxUploadPhoto&format=raw&5dd8f48f96d0d03d3d58cabcba852b5d=1
Request Method:
POST
Status Code: 
502 Bad Gateway (SASE-SWG InvalidResponse)
 
===
 
Response headers
 
HTTP/1.1 502 Bad Gateway (SASE-SWG InvalidResponse)
Proxy-Agent: SASE-SWG
Content-Type: text/html;
charset=UTF-8
Cache-Control: no-store
Proxy-Connection: close
Content-Length: 5307
Date: Thu, 11 Sep 2025 11:12:28 GMT
 
===
 
A 502 Bad Gateway error (SASE-SWG InvalidResponse) occurs when a Secure Access Service Edge (SASE) or Secure Web Gateway (SWG) proxy server fails to receive a valid response from the upstream server it was trying to contact. Common causes include server overload, misconfigured firewalls, issues with DNS settings, or problems with the proxy itself, such as incorrect configurations like the X-Forward-For header. To fix the issue, you can try reloading the page, checking your network configuration (VPN, firewall), clearing your browser's cache, flushing your DNS, and contacting your network administrator if the issue persists. 
 
What it means:
  • The 502 Bad Gateway error is a server-side error, meaning the problem is not usually with your browser or computer. 
     
  • The server acting as a gateway or proxy for your request didn't get a valid response from the server that actually has the requested information. 
     
  • The "(SASE-SWG InvalidResponse)" part indicates the error occurred within the Secure Web Gateway (SWG) portion of a Secure Access Service Edge (SASE) security solution. 

I think you need to contact your server administrator as it nothing I can do more here.

Kind regards,

Dmitrijs

strokesavvy

DNS tests have all passed with flying colours. I need to be upfront with you — the multi-upload isn’t just a nice-to-have for me, it’s essential for launch. I’ve been holding back weeks waiting on it. Single upload is fine for a placeholder, but without gallery multi-upload, the extension isn’t usable for my project. I know you’ve been great at fixing things before, so I’m hoping we can get this one resolved quickly so I can finally open

b2z

Kevin,

I cannot fix anything in extension, because it is not an extension specific problem, it is a server side problem. Extension sends a standard XHR request, and for some reason server response is 502 Bad Gateway. We have a dozen of sites running our extension and never had this issue before.

DNS is the only the one in the various reasons for such behaviour. I am not a server administration expert, I just searched for this error and paste you the answer here to show that it is not an extension specific problem.

Kind regards,

Dmitrijs

strokesavvy

I’m seeing failed XHR responses on the gallery multi-upload since the dev version upgrade.

Single uploads still work fine on the same server.
DNS and PHP limits check out clean.
Dropzone initialises and points to the correct URL.
The handler (ajaxUploadPhoto) no longer returns a valid response.
This worked months ago on the exact same server config — no changes here.
If you can’t reach the upload endpoint from your side, that would be a connection/proxy issue on your end, not DNS. From my side, there are no 502 errors — just the gallery field failing silently.

If this can’t be fixed, then the extension is being sold incorrectly as supporting multi-image upload, when in practice it doesn’t.

Can you please confirm if you can reproduce the upload failure directly in my install?

b2z

> I’m seeing failed XHR responses on the gallery multi-upload since the dev version upgrade.

Sure, because before dev upgrade gallery multi-upload did not work and it was fixed. Here is my explanation of the bug and the fix.

Now upload sends request to the correct URL, but it is facing 502 error from SASE-SWG and it is on your install. And I think the problem here is in SASE-SWG that simply do not like such XHR requests.

===

Secure web gateways (SWGs) are a core part of secure access service edge (SASE) architecture. A secure web gateway (SWG) is an on-premises or cloud-delivered network security technology that filters internet traffic and enforces corporate and regulatory policy compliance. It filters traffic and enforces security policies before allowing access to web resources.

Here’s how it works:

Request is first sent to the SWG. The SWG checks the request against defined policies. It looks at the destination URL, the user’s identity, and the type of content being accessed. If the request is safe and allowed, the SWG forwards it to the internet. If not, the request is blocked.

The same happens in reverse. Responses from the internet are inspected by the SWG before they reach the user. This prevents malware, phishing pages, or other malicious content from making it through.

In other words:

The SWG becomes a checkpoint for both outgoing and incoming web traffic.

It does this using key security functions such as:

  • URL filtering

  • Anti-malware scanning

  • Application control

Some solutions also include data loss prevention (DLP), HTTPS inspection, and other controls.

===

We have similar problems with XHR requests, for example voting did not work and it was a mod_sceurity issue on the server side. See this thread. The client contacted hosting provider and they helped to solve it.

Please contact your hosting provider explaining the error you have. They should help.

Kind regards,

Dmitrijs

strokesavvy

Dmitrijs,

I purchased NorrCompetition along with the Extras Bundle specifically for the advertised gallery multi-upload feature.

Multi-upload worked on this same server months ago.
Since the dev version upgrade it has never once worked here, not even for a single file.
I have tested under PHP 8.1 and 8.2, with DNS, mod_security, and PHP limits all confirmed fine.
Single uploads work, but gallery multi-upload consistently fails.
You have attempted fixes on three occasions and the issue remains.
That means the extension and bundle do not deliver the advertised functionality. The package is not fit for purpose for my project.

I therefore request a refund for NorrCompetition and the Extras Bundle.

Kev

strokesavvy

I have a different way forward with this, do I have your permission to edit the code so I can have a working multi-upload please? I have tested a personal php script and it worked but will need to make changes so the files store in a manner that suits my setup ie, foldername/{username}. 

Kev

b2z

Kevin,

I have installed 2.0.10-dev version with multi upload fix. The bug was for upload in admin panel. Please check, both front and admin uploads.

Kind regards,

Dmitrijs

b2z

And yes, you have the rights to modify the code, it is under GPL. But note, that you will lose your edit after version updates.

strokesavvy

Both front and back panels fail but I have already made code to work in a new submission box

b2z

Check entry id=12, I have uploaded additional photos in admin. It does not fail.

strokesavvy

Thats because I have fixed it! There were two dropzones fighting each other, now I have disabled one everything works as it should, my server was working correct. I created a module that strips the first dropzone discovery, thats what the problem was

b2z

The latest 2.0.10-dev is also working normally. You can check it by yourself on our playground.

https://playground.norrnext.com/administrator/ user: demoadmin, pass: demoadmin. See Test Contest there.

strokesavvy

I dont think you are reading what I'm saying, your dev version was not working on my server, your code had dropzone discovery on which was the reason why it would not work on my server. Check the module called Strokesavvy multi loader, thats the reason why it now works correctly so if its working on your other servers thats fantastic but it wasnt working on mine until I made the fix

b2z

I don't get it. I check your module, it is disabled. Upload is working. Have you changed anything in the extension?

strokesavvy

I see you have fixed and uploaded a new dev version thank you, thats why I have disabled the module, I knew we would get there in the end my friend

b2z

Hi Kevin!

I understand.

I am closing this thread. Should you still experience problems, please open a new support thread.

Thank you.

Kind regards,

Dmitrijs

Support information

Support hours: You can get our help: Monday - Friday / 09:00 to 17:00 (GMT+3), but not limited. Our staff is pleased to provide Premium support to every paid subscriber asap, but sometimes you should be ready to wait for our reply for up to 3 days.


Our time: / Your time:

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. We also ask you to remove temporary credentials at your site after the problem is resolved. Thank you.

Support of free extensions is not provided on this forum. Please submit your questions or report issues via Github tracker. See link on the product page.