gina 0.6.22-alpha.1 → 0.6.22

package/CHANGELOG.md

@@ -6,6 +6,12 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.22 - 2026-09-02
+### Fixed
+* Fixed a form submit that failed at the transport layer settling silently. When the network was down, the connection was refused, or the server was restarting, the request settled with no HTTP status and neither `error.<formId>` nor `error.<formId>.hform` was dispatched, so a handler declared with `data-gina-form-event-on-submit-error` never ran while the form released its submit trigger and reported nothing to the visitor. Such a failure now dispatches both events with `status: 408` and `transportError: true`, the latter distinguishing it from a genuine request timeout. Handlers matching on `status >= 400` keep working unchanged. This code ships in the browser bundle, so consuming bundles need a rebuild as well as a restart.
+### Security
+* Fixed prototype pollution on the request path. Client-supplied bracket-notation field names such as `__proto__[x]`, `constructor[prototype][x]` and their percent-encoded forms reached an unguarded property assignment in the data helper key-path nesting, and `merge()` copied an own `__proto__` key — the shape `JSON.parse` produces — through its `for...in` loops. Both sources now reject the same three key names — rejecting the key name is what closes this, since an own `__proto__` (the shape `JSON.parse` produces) satisfies an own-property check. The sources were reachable from query strings, urlencoded and JSON request bodies, and multipart text-field names; a polluted prototype could influence outbound request options and safe-method or exemption checks. Note the rejection is by key NAME at any depth of a bracket-notation path, and the field is dropped SILENTLY (throwing on the request-parse path would turn one bad field into a 500): `job[constructor]=x` and a JSON key `{"spec":{"prototype":"v1"}}` previously parsed and no longer do, while a flat top-level field of those names is unaffected. `__proto__` was never a usable field name, but `constructor` and `prototype` are ordinary words — grep your field names and API payloads before upgrading. The affected modules also ship in the browser bundle, so consuming bundles need a rebuild as well as a restart.
+
 ## 0.6.21 - 2026-08-30
 ### Fixed
 * #B442 - `route.request()` now settles its callback exactly once on every outcome, and an outbound request that fails can no longer take the bundle down. The `ClientRequest` returned by `http(s).get` was discarded, so nothing could attach an `error` listener to it: a dial failure whose code is carved out of the process-level handler left the caller waiting forever with nothing logged, while a code that is not carved out (`ETIMEDOUT`, `EHOSTUNREACH`, `ENETUNREACH`) escalated to an uncaughtException and terminated the bundle. A response stream that died mid-body behaved the same way for a different reason: the error was assigned to a local and delivery waited on an `end` event that never arrives. All four exit paths now run through a single-settle latch, so the callback receives an ordinary error argument - the shape consuming code already handles - and can never be invoked twice. `options.timeout` is honoured for the first time: it reached `http(s).get` and Node emitted `timeout` without destroying the socket, and the request object was unreachable, so the option silently did nothing; on expiry the request is now destroyed and the callback settles with an Error carrying `code` set to `ETIMEDOUT`. A request sent without a callback logs a warning on a dial failure instead of throwing. The browser bundle carries `lib/routing`, so pickup is a bundle restart AND a re-bake.

package/README.md

@@ -62,29 +62,24 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.21
+## What's in 0.6.22
 
 > **Restart your bundles AND rebuild them.** This release changes the browser
-> bundle: all three fixes below ship in `gina.min.js`. A restart alone updates
-> the server half only — each bundle bakes its own copy of the client assets,
-> so a restart without `gina bundle:build` leaves the browser running the old
-> code.
+> bundle: both fixes below ship in `gina.min.js`. A restart alone updates the
+> server half only — each bundle bakes its own copy of the client assets, so a
+> restart without `gina bundle:build` leaves the browser running the old code.
 
-> **No settings reset.** `0.6.21` is a patch — the `shortVersion` stays `0.6`, so
+> **No settings reset.** `0.6.22` is a patch — the `shortVersion` stays `0.6`, so
 > your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-**Three availability and correctness fixes, two of them reported from the
-field.** An outbound request that failed could hang its caller forever or take
-the bundle down; `merge()` threw on a null array element; and on Safari, every
-modifier chord — paste, select-all, copy, cut, undo — was dead in validated
-fields that suppress autocomplete. **One change may require action** —
-`options.timeout` on an outbound request was accepted but inert, and now
-actually aborts the request; details in the
-[migration guide](https://gina.io/docs/migration).
-
-- **Fixed — an outbound `route.request()` now settles its callback on every outcome (#B442).** The request object returned by `http(s).get` was discarded, so nothing could attach an `error` listener to it, and a failed outbound call took one of two paths — neither reaching your callback. When the failure code was one the process-level handler tolerates (`ECONNREFUSED`, `ECONNRESET`, `EPIPE`) the process survived and the callback was simply never invoked: no error, no log line, and in anything serialized (a worker at concurrency 1, a queue processor) a permanent stall with nothing to diagnose it by. When the code was not one of those (`ETIMEDOUT`, `EHOSTUNREACH`, `ENETUNREACH` — a peer that stops answering, a route that goes away) the unhandled `error` became an `uncaughtException` and the bundle was terminated. A response stream dying mid-body behaved like the first case for a different reason: the error was recorded and delivery waited on an `end` event a broken stream never emits. All exit paths now run through a single-settle latch, so the callback is invoked **exactly once** on every outcome and can never be invoked twice. **Action if you already set `options.timeout`:** it previously did nothing — it reached `http(s).get`, but Node only *emits* a `timeout` event and never destroys the socket, and the request object was unreachable. It is now honoured: on expiry the request is destroyed and the callback settles with an `Error` carrying `code === 'ETIMEDOUT'`. Re-check the value against your slowest legitimate response before upgrading, or remove the option to keep the previous unbounded behaviour. A request sent without a callback now warns on a dial failure instead of throwing.
-- **Fixed — `merge()` no longer throws on a null array element (#B443).** An id-keyed array carrying a `null` raised `TypeError: Cannot read properties of null` from deep inside the merge — on either operand, at any index. `typeof null` is `'object'`, so a null element passed every type test and the next property access dereferenced it; seven distinct shapes threw, across the collection entry guards, the id-roster loops, the override walk and the per-element tests. Since every configuration overlay travels through this code, any such shape was a whole-merge kill. A null element is now treated as an element with no key: it matches nothing, blocks nothing and contributes nothing. Shapes that previously worked are unchanged — the regression suite pins them byte-identical. This closes the read side of the family whose write side shipped in `0.6.20`.
-- **Fixed — Safari: modifier chords work again in validated fields with a suppressed autocomplete (#B444).** On Safari, a live-checked field carrying `autocomplete="off"` (or `"false"`) could not be pasted into — and select-all, copy, cut and undo were equally dead. Nothing was inserted, **no `paste` or `beforeinput` event was dispatched anywhere on the page**, and typing kept working, so nothing pointed at the framework. The form-level keydown proxy was cancelling the native keydown before the Safari typing interception could decide anything, and `preventDefault` on a native keydown suppresses the browser's editing command itself. The proxy now defers that decision to the interception, which deliberately lets modifier chords run natively. Typing interception, caret integrity and autofill suppression on those fields are unchanged; Chromium-family browsers were never affected.
+**A prototype-pollution fix on the request path, and a form submit that failed
+silently when the network did.** The first is a security fix reachable from any
+request that carries field names — upgrade it ahead of the second. The second is
+a client-side fix reported from the field: a submit that failed at the transport
+layer told the visitor nothing.
+
+- **Security — prototype pollution on the request path (#B446).** Client-supplied bracket-notation field names reached an unguarded property assignment in the data helper's key-path nesting: `__proto__[x]=y`, `constructor[prototype][x]=y` and their percent-encoded forms all wrote to `Object.prototype`, and did so silently — the parsed body came back empty, so nothing in the request looked wrong. Separately, `merge()` copied an **own** `__proto__` key — the shape `JSON.parse` produces — through its `for...in` loops. The sources were reachable from query strings, urlencoded and JSON request bodies, `request.query.inheritedData`, and multipart text-field names. A polluted prototype could then influence code that reads a property it expects to be absent: outbound request options (host, port, auth, and the TLS certificate check), and the safe-method and exemption checks. Both sources now reject the same three key names — rejecting the key name is what closes this, since an own `__proto__` (the shape `JSON.parse` produces) satisfies an own-property check. **One thing to check before upgrading.** A field or key whose *path* contains a `__proto__`, `constructor` or `prototype` segment is now dropped from the parsed body instead of being nested — silently, since throwing on the request-parse path would turn one bad field into a 500. `__proto__` was never a usable field name, but `constructor` and `prototype` are ordinary words: if a form posts `job[constructor]=…`, or a JSON body carries a `prototype` key, that value no longer arrives. Flat top-level form fields of those names are unaffected. Grep your field names and API payloads for them. The affected modules also ship in the browser bundle, so a rebuild is part of picking this up, not just a restart.
+- **Fixed — a form submit that fails at the transport layer now reports it (#B447).** When the network was down, the connection was refused, or the server was restarting, the request settled with no HTTP status and neither `error.<formId>` nor `error.<formId>.hform` was dispatched — so a handler declared with `data-gina-form-event-on-submit-error` never ran, while the form released its submit trigger and told the visitor nothing. The failure was indistinguishable from a form that had simply done nothing. Such a failure now dispatches both events with `status: 408` and `transportError: true` — the 408 keeps handlers that match on `status >= 400` working unchanged, and `transportError` is what separates it from a genuine request timeout. **What to check:** if you branch on `result.status`, a transport failure will now enter your error branch where previously it entered nothing at all.
 
 ## Documentation
 

package/ROADMAP.md

@@ -73,6 +73,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.19` ✅ | **Security**: credentials carried in a request URL no longer reach the logs — every log message is redacted at the logger's single pre-render point before any sink renders it; configured per bundle in `settings.json > log.redact`, on by default with a built-in credential set, your own `patterns`, and every `${secret:KEY}` value masked verbatim. **Security**: concurrent calls to the same Couchbase entity method no longer cross-deliver results — the completion trigger carried no call identity, so the first query to finish woke every in-flight caller with its own payload. **Fixed**: a connector callback that throws is no longer invoked a second time, and a failed Couchbase query no longer settles its caller twice. **Fixed**: a logged `Error` keeps its message, stack, own properties and `cause` chain. **Fixed**: `merge()` no longer rewrites the object it was given. Restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.18`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
 | **Q4 2026** | `0.6.20` ✅ | **Security**: concurrent calls to an emit-style entity method are now paired to the call each completion came from. Both call forms (`await entity.method()` and `util.promisify(entity.method)`) paired by arrival order with no call identity, so one call that never signalled completion — it neither emitted its trigger nor returned a Promise that settled, typically because something threw inside an asynchronous callback and was swallowed as an unhandled rejection — left its slot at the head of that method's queue forever: every caller after it received the *next* caller's record, the last one hung, and each further lost completion made it one caller worse. Where the method reads a user-scoped or ownership-bearing record, a check performed on the returned row could pass for the wrong principal. The trigger is data-dependent, not load-dependent — invisible in a load test, present in any long-lived process. Every call now runs inside its own async context, a completion for an already-settled call is dropped rather than handed to the next caller, one reaching the entity outside every call's context still pairs in arrival order and logs `DISPATCH:NO_CONTEXT` at debug level, and the `promisify` form chains on a Promise the method returns instead of discarding it. New opt-in `settings.json > model.emitTimeout` (ms) bounds a call that never completes. **Fixed**: `merge()` no longer duplicates a number the target already holds at a different index, and merges a nested array once per level instead of twice. **Fixed**: `merge()` no longer throws `TypeError: Cannot create property 'id' on string` when a target array that repeats a primitive is merged with an array of objects — a configuration overlay hitting that shape killed the boot. Restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.19`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
 | **Q4 2026** | `0.6.21` ✅ | **Fixed**: an outbound `route.request()` now settles its callback on every outcome — the request object was discarded, so nothing could attach an `error` listener, and a dial failure either never invoked the callback at all (a permanent stall for anything serialized, with nothing logged) or reached `uncaughtException` and terminated the bundle; a response stream dying mid-body waited on an `end` event it would never emit. `options.timeout` was accepted but inert — Node only emits a `timeout` event and never destroys the socket — and is now honoured, so a value set in the belief that it capped the call will begin aborting requests at that budget. **Fixed**: `merge()` no longer throws `TypeError: Cannot read properties of null` on an id-keyed array carrying a `null` element, on either operand at any index — the read-side counterpart of the write-side fix that shipped in `0.6.20`. **Fixed**: on Safari, modifier chords (paste, select-all, copy, cut, undo) work again in live-checked fields carrying `autocomplete="off"` — the form-level keydown proxy cancelled the native keydown before the typing interception could decide anything, and `preventDefault` on a native keydown suppresses the browser's editing command itself, so no `paste` event was dispatched anywhere; Chromium-family browsers were never affected. Restart **and** rebuild your bundles (the browser bundle changed — all three fixes ship in `gina.min.js`). |
+| **Q4 2026** | `0.6.22` ✅ | **Security**: prototype pollution on the request path — client-supplied bracket-notation field names (`__proto__[x]`, `constructor[prototype][x]`, and their percent-encoded forms) reached an unguarded property assignment in the data helper's key-path nesting and wrote to `Object.prototype` silently (the parsed body came back empty, so nothing in the request looked wrong), and `merge()` copied an **own** `__proto__` key — the shape `JSON.parse` produces — through its `for...in` loops. Reachable from query strings, urlencoded and JSON request bodies, `request.query.inheritedData` and multipart text-field names; a polluted prototype could then influence code reading a property it expects to be absent — outbound request options (host, port, auth, the TLS certificate check) and the safe-method and exemption checks. Both sources now reject the same three key names — rejecting the key name is what closes this, since an own `__proto__` (the shape `JSON.parse` produces) satisfies an own-property check. **Fixed**: a form submit that fails at the TRANSPORT layer (network down, connection refused, server restarting) settled with no HTTP status and dispatched neither `error.<formId>` nor `error.<formId>.hform`, so a handler declared with `data-gina-form-event-on-submit-error` never ran while the form released its submit trigger and reported nothing to the visitor; both events now fire with `status: 408` and `transportError: true`, the latter distinguishing it from a genuine request timeout, and handlers matching on `status >= 400` keep working unchanged. Restart **and** rebuild your bundles (the browser bundle changed — both fixes ship in `gina.min.js`). |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys · sequence primitive · OAuth2 client-credentials egress |

package/framework/v0.6.22/VERSION

@@ -0,0 +1 @@
+0.6.22

package/framework/{v0.6.22-alpha.1 → v0.6.22}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -2179,6 +2179,31 @@ define("requireLib", function(){});
  */
 function Merge() {
 
+    /**
+     * #B446 — keys that must never be written through by a merge. `__proto__` is an
+     * accessor on Object.prototype, so assigning it walks through to the prototype;
+     * `constructor`/`prototype` reach it in two hops. JSON.parse produces an OWN
+     * `__proto__` key, so an own-property check alone does NOT stop this — the key
+     * name has to be rejected as well. Request bodies reach merge directly
+     * (core/server.js:6657 merges JSON.parse output as the SOURCE), so this is a
+     * request-path guard, not a defensive nicety.
+     *
+     * Key rejection is the WHOLE guard, deliberately. The first cut of #B446 also
+     * skipped inherited enumerable source properties, which broke every entity in
+     * the model registry: lib/model.js setModel round-trips entity instances
+     * through merge, and all six SQL connectors attach their .sql-derived query
+     * methods to the PROTOTYPE, so an own-only copy silently dropped them
+     * (`db.xEntity.getOneById is not a function`). merge therefore copies the
+     * chain, as it always has; only these three key names are refused.
+     *
+     * @param {string} k - candidate key
+     * @returns {boolean} true when the key must be skipped
+     * @private
+     */
+    var isUnsafeMergeKey = function(k) {
+        return k === '__proto__' || k === 'constructor' || k === 'prototype';
+    };
+
     var newTarget           = []
         , originalValueshasBeenCached = false
         //, keyComparison     = 'id' // use for collections merging [{ id: 'val1' }, { id: 'val2' }, {id: 'val3' }, ...]
@@ -2283,6 +2308,9 @@ function Merge() {
                     } else {
                         // Merge the base object
                         for (var name in options) {
+                            // #B446 — reject prototype-reaching key names.
+                            if ( isUnsafeMergeKey(name) ) { continue }
+
                             if (!target) {
                                 target = { name: null }
                             }
@@ -2344,6 +2372,9 @@ function Merge() {
                                         clone = {};
                                         // copy props
                                         for (var prop in copy) {
+                                            // #B446
+                                            if ( isUnsafeMergeKey(prop) ) { continue }
+
                                             clone[prop] = copy[prop]
                                         }
                                     }
@@ -2355,6 +2386,9 @@ function Merge() {
                                 if ( !override ) {
                                     // add those in copy not in clone (target)
                                     for (var prop in copy) {
+                                        // #B446
+                                        if ( isUnsafeMergeKey(prop) ) { continue }
+
                                         if (typeof(clone[ prop ]) == 'undefined') {
                                             if ( Array.isArray(copy[ prop ]) && Array.isArray(clone[ prop ]) ) {
                                                 clone[ prop ] = mergeArray(copy[ prop ], clone[ prop ], override);
@@ -2384,6 +2418,9 @@ function Merge() {
                                 } else {
 
                                     for (var prop in copy) {
+                                        // #B446
+                                        if ( isUnsafeMergeKey(prop) ) { continue }
+
                                         if ( typeof(copy[ prop ]) != 'undefined' ) {
                                             //clone[prop] = copy[prop]
                                             if ( Array.isArray(copy[ prop ]) && Array.isArray(clone[ prop ]) ) {
@@ -2694,6 +2731,9 @@ function Merge() {
                         // chain below already does for an object at an occupied index.
                         if (newTarget[a] !== null && typeof(newTarget[a]) == 'object') {
                             for (let k in options[a]) {
+                                // #B446
+                                if ( isUnsafeMergeKey(k) ) { continue }
+
                                 if (!newTarget[a].hasOwnProperty(k)) {
                                     newTarget[a][k] = options[a][k]
                                 }
@@ -11268,6 +11308,25 @@ function DataHelper(){
 
     var parseLocalObj = function(obj, key, k, value) {
 
+        // #B446 — a bracket-notation field name is client-supplied and every segment is
+        // used as an assignment target below (`obj[ key[k] ] = ...`). `__proto__` is an
+        // accessor on Object.prototype, so assigning through it mutates the prototype for
+        // the whole process; `constructor`/`prototype` reach it in two hops. Measured
+        // before the fix: `__proto__[polluted]=x`, `constructor[prototype][polluted]=x`
+        // and the percent-encoded `%5F%5Fproto%5F%5F[polluted]=x` each polluted
+        // Object.prototype while the parsed body still read `{}` — i.e. silently.
+        // Drop the path rather than throwing: these names are never legitimate, and a
+        // throw on the request-parse path would turn one bad field into a 500.
+        // Kept INLINE (not a closure helper) because test/core/validator-send-formdata-
+        // nesting.test.js extracts this function's source text and evals it standalone to
+        // pin client/server parity — a helper call would be a ReferenceError there, and
+        // the client-side twin in the validator plugin is inline for the same reason.
+        for (var _s = 0, _sLen = key.length; _s < _sLen; ++_s) {
+            if ( key[_s] === '__proto__' || key[_s] === 'constructor' || key[_s] === 'prototype' ) {
+                return obj;
+            }
+        }
+
         for (let i=0,len=key.length; i<len; i++) {
             // by default
             let _key = key[k];
@@ -13134,6 +13193,17 @@ function ValidatorPlugin(rules, data, formId, culture) {
      */
     var nestBracketNotationKey = function(obj, key, k, value) {
 
+        // #B446 — client-side twin of the server guard in helpers/data. Field names come
+        // from the form / FormData, so a segment named `__proto__`, `constructor` or
+        // `prototype` would assign through to Object.prototype for the whole page. Drop
+        // the path rather than throwing: these names are never legitimate field names, and
+        // a throw here would break submission of the entire form.
+        for (let _s = 0, _sLen = key.length; _s < _sLen; ++_s) {
+            if ( key[_s] === '__proto__' || key[_s] === 'constructor' || key[_s] === 'prototype' ) {
+                return obj;
+            }
+        }
+
         for (let i = 0, len = key.length; i < len; i++) {
             // by default
             let _key = key[k];
@@ -14156,19 +14226,51 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         }
 
 
-                    } /**else if ( xhr.readyState == 4 && xhr.status == 0 ) { // unknown error
-                        // Consider also the request timeout
-                        // Modern browser return readyState=4 and status=0 if too much time passes before the server response.
-                        result = { 'status': 408, 'message': 'XMLHttpRequest Exception: unkown error' };
+                    } else if ( xhr.readyState == 4 && xhr.status === 0 ) {
+                        // #B447 — TRANSPORT-layer failure: network down, connection
+                        // refused, DNS gone, the server process restarting. XHR settles
+                        // at readyState 4 with status 0, which fails BOTH `/^2/.test()`
+                        // and `status != 0` above. This arm existed but was commented
+                        // out and there was no trailing `else`, so neither `error.<id>`
+                        // nor `error.<id>.hform` was emitted — and `error.<id>.hform` is
+                        // exactly what `data-gina-form-event-on-submit-error` registers
+                        // (see listenToXhrEvents), so a consumer's declared submit-error
+                        // handler was silent for the failure it most needs to cover.
+                        // The `loadend` fail-safe still released the trigger, so the form
+                        // spun, re-enabled, and said nothing.
+                        //
+                        // Shape mirrors the sibling `xhr.ontimeout` handler below rather
+                        // than the old commented block: same 408 + `error` key (the
+                        // codebase convention for a client-side XHR failure, also used by
+                        // utils/events.js), same #B175
+                        // removeAttribute, same onUpload branch. 408 keeps range-checking
+                        // handlers (`status >= 400`) working; `transportError` is what
+                        // distinguishes this from a genuine timeout, which matters because
+                        // `ontimeout` emits a bare 408 for a different failure.
+                        //
+                        // The stash goes to eventData.ERROR, not .onerror: the three
+                        // sibling arms in this same readyState chain all write .error,
+                        // it is what the readers actually look at (utils/events.js and
+                        // the validate handler), and it is the key the pre-validation
+                        // cleanup deletes. The on* keys the ontimeout/onprogress
+                        // handlers use are written but never read.
+                        result = {
+                            'status'        : 408,
+                            'transportError': true,
+                            'error'         : 'Transport failure: the request did not reach the server'
+                        };
+
+                        $form.eventData.error = result;
+                        // #B175 — remove, never setAttribute(..., false)
+                        $form.target.removeAttribute('data-gina-form-loading');
+
                         XHRData = result;
                         // update toolbar
                         if ( gina && typeof(window.ginaToolbar) != 'undefined' && window.ginaToolbar && XHRData ) {
                             try {
-                                // don't refresh for html datas
                                 if ( envIsDev && typeof(XHRData) != 'undefined' && /\/html/.test(contentType) ) {
                                     window.ginaToolbar.update("data-xhr", XHRData);
                                 }
-
                             } catch (err) {
                                 throw err
                             }
@@ -14176,16 +14278,16 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
                         // intercept upload
                         if ( /^gina\-upload/i.test(id) ) {
-                            result.message = 'XMLHttpRequest Exception: trying to render an unknwon file.'
                             onUpload(gina, $target, 'error', id, result);
                         }
+
                         triggerEvent(gina, $target, 'error.' + id, result);
 
                         if (hFormIsRequired)
                             triggerEvent(gina, $target, 'error.' + id + '.hform', result);
 
                         return;
-                    }*/
+                    }
                 }
 
             };