From 64f51bd3ddd362d25012edef9af692ddd1fd4fc7 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Sun, 11 May 2014 15:35:54 +0200 Subject: [ticket/12099] Clean some paths before using them PHPBB3-12099 --- phpBB/phpbb/path_helper.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'phpBB/phpbb') diff --git a/phpBB/phpbb/path_helper.php b/phpBB/phpbb/path_helper.php index 0d83e7447e..eb2cbf7313 100644 --- a/phpBB/phpbb/path_helper.php +++ b/phpBB/phpbb/path_helper.php @@ -98,7 +98,7 @@ class path_helper { $path = substr($path, strlen($this->phpbb_root_path)); - return $this->get_web_root_path() . $path; + return $this->filesystem->clean_path($this->get_web_root_path() . $path); } return $path; @@ -158,7 +158,7 @@ class path_helper */ if ($path_info === '/' && preg_match('/app\.' . $this->php_ext . '\/$/', $request_uri)) { - return $this->web_root_path = $this->phpbb_root_path . '../'; + return $this->web_root_path = $this->filesystem->clean_path('../' . $this->phpbb_root_path); } /* -- cgit v1.2.1 From 58cfdfe14386e48047f3620d1c09218fdbaac5f0 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Sun, 11 May 2014 14:54:51 +0200 Subject: [ticket/12099] Correctly fix go back to root before prepending the root path This allows moving app.php outside of phpBB and still work as expected PHPBB3-12099 --- phpBB/phpbb/path_helper.php | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) (limited to 'phpBB/phpbb') diff --git a/phpBB/phpbb/path_helper.php b/phpBB/phpbb/path_helper.php index eb2cbf7313..b206f491d0 100644 --- a/phpBB/phpbb/path_helper.php +++ b/phpBB/phpbb/path_helper.php @@ -184,17 +184,21 @@ class path_helper * Append ../ to the end of the phpbb_root_path as many times * as / exists in path_info */ - return $this->web_root_path = $this->phpbb_root_path . str_repeat('../', $corrections); + $this->web_root_path = $this->filesystem->clean_path(str_repeat('../', $corrections) . $this->phpbb_root_path); + } + else + { + /* + * If we're here it means we're at a re-written path, so we must + * correct the relative path for web URLs. We must append ../ + * to the end of the root path as many times as / exists in path_info + * less one time (because the script, e.g. /app.php, doesn't exist in + * the URL) + */ + $this->web_root_path = $this->filesystem->clean_path(str_repeat('../', $corrections - 1) . $this->phpbb_root_path); } - /* - * If we're here it means we're at a re-written path, so we must - * correct the relative path for web URLs. We must append ../ - * to the end of the root path as many times as / exists in path_info - * less one time (because the script, e.g. /app.php, doesn't exist in - * the URL) - */ - return $this->web_root_path = $this->phpbb_root_path . str_repeat('../', $corrections - 1); + return $this->web_root_path; } /** -- cgit v1.2.1 From 638d43d6fea5b5c3c1690b23d7cbe7b9bcef48c9 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Tue, 13 May 2014 20:04:53 +0200 Subject: [ticket/12099] Fix clean_path() ".." stripping when previous directory was "." PHPBB3-12099 --- phpBB/phpbb/filesystem.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'phpBB/phpbb') diff --git a/phpBB/phpbb/filesystem.php b/phpBB/phpbb/filesystem.php index 683a12ab76..77517082e5 100644 --- a/phpBB/phpbb/filesystem.php +++ b/phpBB/phpbb/filesystem.php @@ -35,7 +35,7 @@ class filesystem continue; } - if ($part === '..' && !empty($filtered) && $filtered[sizeof($filtered) - 1] !== '..') + if ($part === '..' && !empty($filtered) && $filtered[sizeof($filtered) - 1] !== '.' && $filtered[sizeof($filtered) - 1] !== '..') { array_pop($filtered); } -- cgit v1.2.1 From edc5908e483bbd36f7dff641039ff0d37a4fdc5a Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Mon, 9 Jun 2014 00:48:02 +0200 Subject: [ticket/12099] Deduplicate path generation PHPBB3-12099 --- phpBB/phpbb/path_helper.php | 27 +++++++-------------------- 1 file changed, 7 insertions(+), 20 deletions(-) (limited to 'phpBB/phpbb') diff --git a/phpBB/phpbb/path_helper.php b/phpBB/phpbb/path_helper.php index b206f491d0..e63aa06a57 100644 --- a/phpBB/phpbb/path_helper.php +++ b/phpBB/phpbb/path_helper.php @@ -174,30 +174,17 @@ class path_helper $corrections = substr_count($path_info, '/'); /* - * If the script name (e.g. phpBB/app.php) exists in the - * requestUri (e.g. phpBB/app.php/foo/template), then we - * are have a non-rewritten URL. + * If the script name (e.g. phpBB/app.php) does not exists in the + * requestUri (e.g. phpBB/app.php/foo/template), then we are rewriting + * the URL. So we must reduce the slash count by 1. */ - if (strpos($request_uri, $script_name) === 0) + if (strpos($request_uri, $script_name) !== 0) { - /* - * Append ../ to the end of the phpbb_root_path as many times - * as / exists in path_info - */ - $this->web_root_path = $this->filesystem->clean_path(str_repeat('../', $corrections) . $this->phpbb_root_path); - } - else - { - /* - * If we're here it means we're at a re-written path, so we must - * correct the relative path for web URLs. We must append ../ - * to the end of the root path as many times as / exists in path_info - * less one time (because the script, e.g. /app.php, doesn't exist in - * the URL) - */ - $this->web_root_path = $this->filesystem->clean_path(str_repeat('../', $corrections - 1) . $this->phpbb_root_path); + $corrections--; } + // Prepend ../ to the phpbb_root_path as many times as / exists in path_info + $this->web_root_path = $this->filesystem->clean_path(str_repeat('../', $corrections) . $this->phpbb_root_path); return $this->web_root_path; } -- cgit v1.2.1 From 1a6d8dd94d916a7dddbfc6abca8cd4a2f1adf5b9 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Mon, 9 Jun 2014 01:10:18 +0200 Subject: [ticket/12099] Prepend ./ to path to fix assets PHPBB3-12099 --- phpBB/phpbb/path_helper.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'phpBB/phpbb') diff --git a/phpBB/phpbb/path_helper.php b/phpBB/phpbb/path_helper.php index e63aa06a57..685a5ec180 100644 --- a/phpBB/phpbb/path_helper.php +++ b/phpBB/phpbb/path_helper.php @@ -158,7 +158,7 @@ class path_helper */ if ($path_info === '/' && preg_match('/app\.' . $this->php_ext . '\/$/', $request_uri)) { - return $this->web_root_path = $this->filesystem->clean_path('../' . $this->phpbb_root_path); + return $this->web_root_path = $this->filesystem->clean_path('./../' . $this->phpbb_root_path); } /* @@ -184,7 +184,9 @@ class path_helper } // Prepend ../ to the phpbb_root_path as many times as / exists in path_info - $this->web_root_path = $this->filesystem->clean_path(str_repeat('../', $corrections) . $this->phpbb_root_path); + $this->web_root_path = $this->filesystem->clean_path( + './' . str_repeat('../', $corrections) . $this->phpbb_root_path + ); return $this->web_root_path; } -- cgit v1.2.1