Skip to content
Permalink
Browse files

Fixed downloading of files with dots

  • Loading branch information...
davidsteinsland committed Feb 15, 2015
1 parent 10b6ba7 commit 5fd7396e479753b5c967ecffc45e52eac62ca9cc
Showing with 20 additions and 1 deletion.
  1. +1 −1 lib/Cake/Network/CakeResponse.php
  2. +19 −0 lib/Cake/Test/Case/Network/CakeResponseTest.php
@@ -1336,7 +1336,7 @@ public function file($path, $options = array()) {
'download' => null
);
if (strpos($path, '..') !== false) {
if (strpos($path, '../') !== false || strpos($path, '..\\') !== false) {
throw new NotFoundException(__d(
'cake_dev',
'The requested file contains `..` and will not be read.'
@@ -1170,13 +1170,32 @@ public function testFileNotFound() {
* test file with ..
*
* @expectedException NotFoundException
* @expectedExceptionMessage The requested file contains `..` and will not be read.
* @return void
*/
public function testFileWithPathTraversal() {
$response = new CakeResponse();
$response->file('my/../cat.gif');
}
public function testFileWithDotsInFilename() {
$ok = false;
$file = 'my/Some..cat.gif';
try {
$response = new CakeResponse();
$response->file($file);
} catch (NotFoundException $e) {
if (Configure::read('debug') > 0) {
$ok = $e->getMessage() === sprintf('The requested file %s was not found or not readable', APP . $file);
} else {
$ok = $e->getMessage() === 'The requested file was not found';
}
}
$this->assertTrue($ok);
}
/**
* testFile method
*

0 comments on commit 5fd7396

Please sign in to comment.
You can’t perform that action at this time.