Skip to content

Conversation

@SniperSister
Copy link
Contributor

Summary of Changes

I added a new "resolve" method to resolve relative paths without the need for the input path to be an absolute path in the first place. The path in question also doesn't need to exist beforehand, it's a virtual check.

This also allows a better fix for joomla/joomla-cms#24539 that doesn't break symlinks.

@HLeithner
Copy link
Contributor

I think this will not work under windows.
I tested echo resolve('/var\../www///joomla'); and got \\var\..\www\joomla I'm not sure if this is true for posix

Co-Authored-By: Michael Babker <michael.babker@gmail.com>
SniperSister and others added 2 commits March 26, 2020 14:28
Co-Authored-By: Michael Babker <michael.babker@gmail.com>
Co-Authored-By: Michael Babker <michael.babker@gmail.com>
@wilsonge
Copy link
Contributor

This also allows a better fix for joomla/joomla-cms#24539 that doesn't break symlinks.

I don't think this fixes that. I think people in that issue who have symlinks are largely symlink'ing /var/www/joomla/images to /data/joomla-images where they have larger disk attached to /data. That's why people in that issue were asking about whitelisted locations

Having said that this method seems logical and useful anyhow - just don't think you're going to fix the issue mentioned

@SniperSister
Copy link
Contributor Author

I don't think this fixes that. I think people in that issue who have symlinks are largely symlink'ing /var/www/joomla/images to /data/joomla-images where they have larger disk attached to /data. That's why people in that issue were asking about whitelisted locations

It does fix it. We are running into the current issue because we are using realpath for relative path resolutions - however, realpath does also resolve symlinks and that's what's getting is into trouble here

@zero-24
Copy link
Contributor

zero-24 commented Jun 30, 2020

@wilsonge any follow up on this here form your site?

@wilsonge
Copy link
Contributor

Nah feel free to merge. I've said my piece

@mbabker mbabker merged commit 63a4727 into joomla-framework:master Jul 15, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants