Welcome, Guest
Username: Password: Remember me

TOPIC: [FIXED] SECURITY: Missing index.html, on subfolders' path

SECURITY: Missing index.html, on subfolders' path 16 Sep 2013 11:06 #11103

  • Tomaselli
  • Tomaselli's Avatar
  • Online
  • Elite Member
  • Posts: 293
  • Thank you received: 87
  • Karma: 46
In the case of a dynamic upload folder for a file, the default index.html is not checked on each subfolder of the path. it's only checked in the root file field folder.

1st example
field: image
rename filename rule: {BASE}.{EXT}

jcook-component behaviour:
if the "upload_dir_view_image" doesn't exist, it's created and the file index.html is created as well.
Everything is fine here.


2nd example
field: image
rename filename rule: mywhateverfolder/{ID}/{BASE}.{EXT}

jcook-component behaviour:
see behaviour 1st example. nothing changes.
the files are correctly uploaded into the folder: upload_dir_view_image/mywhateverfolder/{ID}/{BASE}.{EXT}

but ONLY the root folder (upload_dir_view_image) will have the index.html


fix:
modify the function process() in the file ROOT\administrator\components\com_component\classes\file\upload.php
	public function process()
	{
		$fileDest = $this->uploadFolder . $this->file->filename;
		
/* hack */
		$basedir = dirname($this->file->filename);
		
		if($basedir != '.'){
			$rootUploadFolder = $this->uploadFolder;
			while($basedir != '.'){
				$this->setUploadFolder($rootUploadFolder . $basedir);
				$basedir = dirname($basedir);
			}
			$this->uploadFolder = $rootUploadFolder;
		}
/* hack */

		if ( !move_uploaded_file($this->file->tmp, $fileDest))
			if(!JFile::upload($this->file->tmp, $fileDest))
				return false;

		//Protect file against execution
		@chmod($fileDest, JSHOP_UPLOAD_CHMOD_FILE);

		return true;
	}
The administrator has disabled public write access.
The following user(s) said Thank You: admin

SECURITY: Missing index.html, on subfolders' path 23 Sep 2013 17:49 #11153

  • admin
  • admin's Avatar
  • Offline
  • Administrator
  • Chef
  • Posts: 3711
  • Thank you received: 987
  • Karma: 140
Coding is now a piece of cake
The administrator has disabled public write access.
Time to create page: 0.073 seconds

Get Started