safer rename/move - issue #51

- new internal function nm_rename_file(): tries to rename, if fails then copy + unlink - replace rename() calls (delete/save/restore post)
cnb · Jan 28, 2013 · b23bce3 · b23bce3
1 parent b47787e
commit b23bce3
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 4 deletions.
diff --git a/news_manager/inc/functions.php b/news_manager/inc/functions.php
@@ -135,6 +135,24 @@ function nm_create_dir($path) {
   return false;
 }
 
+/*******************************************************
+ * @function nm_rename_file
+ * @since 2.3.2
+ * @param $oldfile origin file
+ * @param $newfile destination file
+ * @action rename or move a file - like rename() but safer (Windows)
+ * @link http://www.php.net/manual/en/function.rename.php#56576
+ */
+function nm_rename_file($oldfile,$newfile) {
+  if (!rename($oldfile,$newfile)) {
+   if (copy ($oldfile,$newfile)) {
+	   unlink($oldfile);
+	   return TRUE;
+    }
+    return FALSE;
+  }
+  return TRUE;
+}
 
 /*******************************************************
  * @function nm_create_slug

diff --git a/news_manager/inc/posts.php b/news_manager/inc/posts.php
@@ -40,7 +40,7 @@ function nm_save_post() {
   if (isset($_POST['current-slug'])) {
     $file = $_POST['current-slug'] . '.xml';
     if (dirname(realpath(NMPOSTPATH.$file)) != realpath(NMPOSTPATH)) die(''); // path traversal
-    @rename(NMPOSTPATH . $file, NMBACKUPPATH . $file);
+    @nm_rename_file(NMPOSTPATH . $file, NMBACKUPPATH . $file);
   }
   # empty titles are not allowed
   if (empty($_POST['post-title']) || trim($_POST['post-title']) == '')
@@ -104,7 +104,7 @@ function nm_delete_post($slug) {
   } else {
       # delete post
       if (file_exists(NMPOSTPATH . $file)) {
-        if (rename(NMPOSTPATH . $file, NMBACKUPPATH . $file) && nm_update_cache())
+        if (nm_rename_file(NMPOSTPATH.$file, NMBACKUPPATH.$file) && nm_update_cache())
           nm_display_message(i18n_r('news_manager/SUCCESS_DELETE'), false, $slug);
         else
           nm_display_message(i18n_r('news_manager/ERROR_DELETE'), true);
@@ -127,14 +127,14 @@ function nm_restore_post($backup) {
     if (dirname(realpath(NMPOSTPATH.$current)) == realpath(NMPOSTPATH) && dirname(realpath(NMBACKUPPATH.$backup)) == realpath(NMBACKUPPATH)) // no path traversal
         if (file_exists(NMPOSTPATH . $current) && file_exists(NMBACKUPPATH . $backup))
           $status = unlink(NMPOSTPATH . $current) &&
-                    rename(NMBACKUPPATH . $backup, NMPOSTPATH . $backup) &&
+                    nm_rename_file(NMBACKUPPATH.$backup, NMPOSTPATH.$backup) &&
                     nm_update_cache();
   } else {
     # restore the deleted post
     $backup .= '.xml';
     if (dirname(realpath(NMBACKUPPATH.$backup)) == realpath(NMBACKUPPATH)) // no path traversal
         if (file_exists(NMBACKUPPATH . $backup))
-          $status = rename(NMBACKUPPATH . $backup, NMPOSTPATH . $backup) &&
+          $status = nm_rename_file(NMBACKUPPATH.$backup, NMPOSTPATH.$backup) &&
                     nm_update_cache();
   }
   if (@$status)