Changeset 23269

Timestamp:

2013/11/18 11:02:17 (13 years ago)

Author:

michael_nelson

Message:

#2441 コンテンツ管理 -> ファイル管理 のファイル指定処理が不正　の修正

Location:

branches/version-2_13_1/data/class

Files:

• pages/admin/contents/LC_Page_Admin_Contents_FileManager.php (modified) (2 diffs)
• util/SC_Utils.php (modified) (1 diff)

branches/version-2_13_1/data/class/pages/admin/contents/LC_Page_Admin_Contents_FileManager.php

@@ -127 +127 @@
                         $this->setDispError('select_file', $disp_error);
                     } else {
-                        // ファイルダウンロード
-                        $objFileManager->sfDownloadFile($objFormParam->getValue('select_file'));
-                        SC_Response_Ex::actionExit();
-                    }
+                       $path_exists = SC_Utils::checkFileExistsWithInBasePath($objFormParam->getValue('select_file'),USER_REALDIR);
+                       if ($path_exists) {
+                         // ファイルダウンロード
+                         $objFileManager->sfDownloadFile($objFormParam->getValue('select_file'));
+                         SC_Response_Ex::actionExit();
+                      }
+                  }
                 }
                 break;
@@ -139 +142 @@
                 $objFormParam->setParam($this->createSetParam($_POST));
                 $objFormParam->convParam();
-
                 $this->arrErr = $objFormParam->checkError();
-                if (SC_Utils_Ex::isBlank($this->arrErr)) {
+                $path_exists = SC_Utils::checkFileExistsWithInBasePath($objFormParam->getValue('select_file'),USER_REALDIR);
+                if (SC_Utils_Ex::isBlank($this->arrErr) && ($path_exists)) {
                     $objFileManager->deleteFile($objFormParam->getValue('select_file'));
                 }

branches/version-2_13_1/data/class/util/SC_Utils.php

@@ -2092 +2092 @@
         return array_reverse($arrTrail);
     }
+    
+    /**
+     * Obtain the parts of path that are not the same and confirm if file exists
+     * by reconstructing path with base path.
+     *
+     * @param  string  $file
+     * @param  string  $base_path
+     * @return bool true = exists / false does not exist
+     */
+    public  function checkFileExistsWithInBasePath($file,$base_path) 
+    {  
+        $arrPath = explode('/', str_replace('\\', '/',$file));
+        $arrBasePath = explode('/', str_replace('\\', '/',$base_path));
+        $path_diff = implode("/",array_diff_assoc($arrPath, $arrBasePath));
+        return file_exists(realpath(str_replace('..','',$base_path . $path_diff))) ? true : false;
+    }
 }