Error when checking for htaccess file existance

[mouhammad-zd]

Each time admin panel is accessed, kleeja checks the existence of htaccess file inside folder name correspondent to the foldername key inside the global $config variable, and inside its subfolder thumbs, without checking if the folder itself is found or not.

This behavior exists within includes/adm/start.php on lines 199,204,217.

So suppose that the admin want to put uploaded files in user directory under current correspondent date, and use the following format for upload folder name : uploads/{username}/{year}{month}{day}{week}.

Before any file being uploaded in current date (the folder will not be created), and as kleeja check .htaccess existensce within this folder, this will lead to showing an error inside the admin panel that .htaccess file is not found and that this might be a security issue, when indeed that the directory itself is not found.

The error is gone when the admin uploads at least when file in the this day , as the folder will be created and everything will work as it must.

To Reproduce

1. Login into admin panel
2. click on settings -> upload
3. set the value of folder name for uploaded files as following: uploads/{username}/{year}{month}{day}{week}
4. Refresh page or do logout then login to admin panel

Expected behavior
When the upload folder correspondent to the global $config variable, $config['foldername'] does not exists we must not check, for htaccess existence. so we must add a new condition to check for directory existence before checking for htaccess file existence.

Server (please complete the following information):

• OS: Linux
• PHP version: PHP 8.2.3 (cli) (built: Feb 14 2023 16:57:50) (NTS)
• MySQL version: mysql Ver 15.1 Distrib 10.3.38-MariaDB, for debian-linux-gnu (x86_64) using readline 5.2
• Browser chrome,firefox
• Version 3.1.6

Additional context

This case can be solved as following.

change following lines in includes/adm/start.php:

• change line 199 from:
  if (! file_exists(PATH . $config['foldername'] . '/.htaccess'))
  to:
  if (is_dir(PATH . $config['foldername']) && ! file_exists(PATH . $config['foldername'] . '/.htaccess'))

• change line 204 from:
  if (! file_exists(PATH . $config['foldername'] . '/thumbs/.htaccess'))
  to:
  if (is_dir(PATH . $config['foldername']) && ! file_exists(PATH . $config['foldername'] . '/thumbs/.htaccess'))

• change line 217 from:
  if (! file_exists(PATH . $config['foldername'] . '/thumbs') && (int) $config['thumbs_imgs'] != 0)
  to:
  if (is_dir(PATH . $config['foldername']) && ! file_exists(PATH . $config['foldername'] . '/thumbs') && (int) $config['thumbs_imgs'] != 0)