[7.x.x] - DEV: init.php::preupdate() error

[rskrzypczak]

Discussed in #246

^{Originally posted by davide-alghi March 12, 2026}
I'm updating my extensions installers/updaters, but...

If preupdate() function, in package's init.php, returns false, the import installation stops with error:

2026-03-12 11:41:22.3417 [error][] - vtlib\Deprecated::checkFileAccessForDeletion(cache/usermodule_1773312081.zip) - Sorry! Attempt to access restricted file. realfilepath: 
 - 0 vtlib/Vtiger/Deprecated.php:97  >>  App\Log->error('vtlib\\Deprecated::checkFileAccessForDeletion(cache/usermodule_1773312081.zip) - Sorry! Attempt to access restricted file. realfilepath: ')
 - 1 modules/Settings/ModuleManager/views/ModuleImport.php:159  >>  vtlib\Deprecated->checkFileAccessForDeletion('cache/usermodule_1773312081.zip')
 - 2 app/Controller/ExposeMethod.php:68  >>  Settings_ModuleManager_ModuleImport_View->importUserModuleStep3()
 - 3 modules/Settings/ModuleManager/views/ModuleImport.php:45  >>  Settings_ModuleManager_ModuleImport_View->invokeExposedMethod('importUserModuleStep3')
 - 4 include/main/WebUI.php:161  >>  Settings_ModuleManager_ModuleImport_View->process()
 - 5 index.php:26  >>  Vtiger_WebUI->process()
 - 6 public_html/index.php:13  >>  require('index.php')
2026-03-12 11:41:22.3419 [error][] - Sorry! Attempt to access restricted file.
App\Exceptions\AppException: Sorry! Attempt to access restricted file. in vtlib/Vtiger/Deprecated.php:98
Stack trace:
#0 modules/Settings/ModuleManager/views/ModuleImport.php(159): vtlib\Deprecated::checkFileAccessForDeletion()
#1 app/Controller/ExposeMethod.php(68): Settings_ModuleManager_ModuleImport_View->importUserModuleStep3()
#2 modules/Settings/ModuleManager/views/ModuleImport.php(45): Settings_ModuleManager_ModuleImport_View->invokeExposedMethod()
#3 include/main/WebUI.php(161): Settings_ModuleManager_ModuleImport_View->process()
#4 index.php(26): Vtiger_WebUI->process()
#5 public_html/index.php(13): require('...')
#6 {main}
 - 0 include/main/WebUI.php:164  >>  App\Log->error('Sorry! Attempt to access restricted file.
App\\Exceptions\\AppException: Sorry! Attempt to access restricted file. in vtlib/Vtiger/Deprecated.php:98
Stack trace:
#0 modules/Settings/ModuleManager/views/ModuleImport.php(159): vtlib\\Deprecated::checkFileAccessForDeletion()
#1 app/Controller/ExposeMethod.php(68): Settings_ModuleManager_ModuleImport_View->importUserModuleStep3()
#2 modules/Settings/ModuleManager/views/ModuleImport.php(45): Settings_ModuleManager_ModuleImport_View->invokeExposedMethod()
#3 include/main/WebUI.php(161): Settings_ModuleManager_ModuleImport_View->process()
#4 index.php(26): Vtiger_WebUI->process()
#5 public_html/index.php(13): require(\'...\')
#6 {main}')
 - 1 index.php:26  >>  Vtiger_WebUI->process()
 - 2 public_html/index.php:13  >>  require('index.php')

Maybe this is a regression, because in YF 6.5 it works fine.

Any help is appreciated.
Thanks

[Evan287]

Hey, I looked into this and I think I've identified the issue.
The error is thrown in checkFileAccessForDeletion() at ModuleImport.php:159, but looking at the stack trace, realfilepath is empty when it's called. This suggests the zip file path variable is either never set or gets cleared when preupdate() returns false and the process exits early — so the cleanup code runs but has nothing valid to act on.
My plan is to:

Diff ModuleImport.php against the YF 6.5 version to pinpoint what changed
Find where the zip path is stored before preupdate() is called and trace whether an early false return drops that reference
Add a guard before the deletion call to check that the file path is actually set before attempting cleanup

Before I write anything, does that approach align with how you'd want this handled? And is there a preferred way to test module import flows locally for this project?
Thanks