aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorNicofuma <github@nicofuma.fr>2015-03-29 19:41:13 +0200
committerNicofuma <github@nicofuma.fr>2015-03-29 19:41:13 +0200
commitb9db47e3f52a8723b06e01f15c6e44052c014c42 (patch)
treea95b627f257c1682c211acdb861a6aa27a75a809
parent1efbb5b3bbd8c0b38c0f265453514dfd87ef04f0 (diff)
parent7c5d872344a59f0fe2323d34885e543a09111ca7 (diff)
downloadforums-b9db47e3f52a8723b06e01f15c6e44052c014c42.tar
forums-b9db47e3f52a8723b06e01f15c6e44052c014c42.tar.gz
forums-b9db47e3f52a8723b06e01f15c6e44052c014c42.tar.bz2
forums-b9db47e3f52a8723b06e01f15c6e44052c014c42.tar.xz
forums-b9db47e3f52a8723b06e01f15c6e44052c014c42.zip
Merge pull request #3359 from marc1706/ticket/13568
[ticket/13568] Validate imagick path as readable absolute path closes #3359
-rw-r--r--phpBB/adm/index.php13
-rw-r--r--phpBB/includes/acp/acp_attachments.php2
-rw-r--r--tests/functional/acp_attachments_test.php78
3 files changed, 88 insertions, 5 deletions
diff --git a/phpBB/adm/index.php b/phpBB/adm/index.php
index 85908476a1..49c4be09dc 100644
--- a/phpBB/adm/index.php
+++ b/phpBB/adm/index.php
@@ -524,6 +524,9 @@ function validate_config_vars($config_vars, &$cfg_array, &$error)
$cfg_array[$config_name] = trim($destination);
+ // Absolute file path
+ case 'absolute_path':
+ case 'absolute_path_writable':
// Path being relative (still prefixed by phpbb_root_path), but with the ability to escape the root dir...
case 'path':
case 'wpath':
@@ -542,20 +545,22 @@ function validate_config_vars($config_vars, &$cfg_array, &$error)
break;
}
- if (!file_exists($phpbb_root_path . $cfg_array[$config_name]))
+ $path = in_array($config_definition['validate'], array('wpath', 'path', 'rpath', 'rwpath')) ? $phpbb_root_path . $cfg_array[$config_name] : $cfg_array[$config_name];
+
+ if (!file_exists($path))
{
$error[] = sprintf($user->lang['DIRECTORY_DOES_NOT_EXIST'], $cfg_array[$config_name]);
}
- if (file_exists($phpbb_root_path . $cfg_array[$config_name]) && !is_dir($phpbb_root_path . $cfg_array[$config_name]))
+ if (file_exists($path) && !is_dir($path))
{
$error[] = sprintf($user->lang['DIRECTORY_NOT_DIR'], $cfg_array[$config_name]);
}
// Check if the path is writable
- if ($config_definition['validate'] == 'wpath' || $config_definition['validate'] == 'rwpath')
+ if ($config_definition['validate'] == 'wpath' || $config_definition['validate'] == 'rwpath' || $config_definition['validate'] === 'absolute_path_writable')
{
- if (file_exists($phpbb_root_path . $cfg_array[$config_name]) && !phpbb_is_writable($phpbb_root_path . $cfg_array[$config_name]))
+ if (file_exists($path) && !phpbb_is_writable($path))
{
$error[] = sprintf($user->lang['DIRECTORY_NOT_WRITABLE'], $cfg_array[$config_name]);
}
diff --git a/phpBB/includes/acp/acp_attachments.php b/phpBB/includes/acp/acp_attachments.php
index 147783feae..bffe6f7db3 100644
--- a/phpBB/includes/acp/acp_attachments.php
+++ b/phpBB/includes/acp/acp_attachments.php
@@ -127,7 +127,7 @@ class acp_attachments
'img_create_thumbnail' => array('lang' => 'CREATE_THUMBNAIL', 'validate' => 'bool', 'type' => 'radio:yes_no', 'explain' => true),
'img_max_thumb_width' => array('lang' => 'MAX_THUMB_WIDTH', 'validate' => 'int', 'type' => 'text:7:15', 'explain' => true, 'append' => ' ' . $user->lang['PIXEL']),
'img_min_thumb_filesize' => array('lang' => 'MIN_THUMB_FILESIZE', 'validate' => 'int', 'type' => 'text:7:15', 'explain' => true, 'append' => ' ' . $user->lang['BYTES']),
- 'img_imagick' => array('lang' => 'IMAGICK_PATH', 'validate' => 'path', 'type' => 'text:20:200', 'explain' => true, 'append' => '&nbsp;&nbsp;<span>[ <a href="' . $this->u_action . '&amp;action=imgmagick">' . $user->lang['SEARCH_IMAGICK'] . '</a> ]</span>'),
+ 'img_imagick' => array('lang' => 'IMAGICK_PATH', 'validate' => 'absolute_path', 'type' => 'text:20:200', 'explain' => true, 'append' => '&nbsp;&nbsp;<span>[ <a href="' . $this->u_action . '&amp;action=imgmagick">' . $user->lang['SEARCH_IMAGICK'] . '</a> ]</span>'),
'img_max' => array('lang' => 'MAX_IMAGE_SIZE', 'validate' => 'int', 'type' => 'dimension:3:4', 'explain' => true, 'append' => ' ' . $user->lang['PIXEL']),
'img_link' => array('lang' => 'IMAGE_LINK_SIZE', 'validate' => 'int', 'type' => 'dimension:3:4', 'explain' => true, 'append' => ' ' . $user->lang['PIXEL']),
)
diff --git a/tests/functional/acp_attachments_test.php b/tests/functional/acp_attachments_test.php
new file mode 100644
index 0000000000..8e810a508a
--- /dev/null
+++ b/tests/functional/acp_attachments_test.php
@@ -0,0 +1,78 @@
+<?php
+/**
+ *
+ * This file is part of the phpBB Forum Software package.
+ *
+ * @copyright (c) phpBB Limited <https://www.phpbb.com>
+ * @license GNU General Public License, version 2 (GPL-2.0)
+ *
+ * For full copyright and license information, please see
+ * the docs/CREDITS.txt file.
+ *
+ */
+
+/**
+ * @group functional
+ */
+class phpbb_functional_acp_attachments_test extends phpbb_functional_test_case
+{
+ public function data_imagick_path_linux()
+ {
+ return array(
+ array('/usr/bin', 'Configuration updated successfully'),
+ array('/usr/foobar', 'The entered path “/usr/foobar” does not exist.'),
+ array('/usr/bin/which', 'The entered path “/usr/bin/which” is not a directory.'),
+ );
+ }
+
+ /**
+ * @dataProvider data_imagick_path_linux
+ */
+ public function test_imagick_path_linux($imagick_path, $expected)
+ {
+ if (strtolower(substr(PHP_OS, 0, 5)) !== 'linux')
+ {
+ $this->markTestSkipped('Unable to test linux specific paths on other OS.');
+ }
+
+ $this->login();
+ $this->admin_login();
+
+ $crawler = self::request('GET', 'adm/index.php?i=attachments&mode=attach&sid=' . $this->sid);
+
+ $form = $crawler->selectButton('Submit')->form(array('config[img_imagick]' => $imagick_path));
+
+ $crawler = self::submit($form);
+ $this->assertContains($expected, $crawler->filter('#main')->text());
+ }
+
+ public function data_imagick_path_windows()
+ {
+ return array(
+ array('C:\Windows', 'Configuration updated successfully'),
+ array('C:\Windows\foobar1', 'The entered path “C:\Windows\foobar1” does not exist.'),
+ array('C:\Windows\explorer.exe', 'The entered path “C:\Windows\explorer.exe” is not a directory.'),
+ );
+ }
+
+ /**
+ * @dataProvider data_imagick_path_windows
+ */
+ public function test_imagick_path_windows($imagick_path, $expected)
+ {
+ if (strtolower(substr(PHP_OS, 0, 3)) !== 'win')
+ {
+ $this->markTestSkipped('Unable to test windows specific paths on other OS.');
+ }
+
+ $this->login();
+ $this->admin_login();
+
+ $crawler = self::request('GET', 'adm/index.php?i=attachments&mode=attach&sid=' . $this->sid);
+
+ $form = $crawler->selectButton('Submit')->form(array('config[img_imagick]' => $imagick_path));
+
+ $crawler = self::submit($form);
+ $this->assertContains($expected, $crawler->filter('#main')->text());
+ }
+}