Welcome, Guest
Username: Password: Remember me
  • Page:
  • 1

TOPIC:

SECURITY: Missing index.html, on subfolders' path 16 Sep 2013 11:06 #11103

In the case of a dynamic upload folder for a file, the default index.html is not checked on each subfolder of the path. it's only checked in the root file field folder.

1st example
field: image
rename filename rule: {BASE}.{EXT}

jcook-component behaviour:
if the "upload_dir_view_image" doesn't exist, it's created and the file index.html is created as well.
Everything is fine here.


2nd example
field: image
rename filename rule: mywhateverfolder/{ID}/{BASE}.{EXT}

jcook-component behaviour:
see behaviour 1st example. nothing changes.
the files are correctly uploaded into the folder: upload_dir_view_image/mywhateverfolder/{ID}/{BASE}.{EXT}

but ONLY the root folder (upload_dir_view_image) will have the index.html


fix:
modify the function process() in the file ROOT\administrator\components\com_component\classes\file\upload.php
	public function process()
	{
		$fileDest = $this->uploadFolder . $this->file->filename;
		
/* hack */
		$basedir = dirname($this->file->filename);
		
		if($basedir != '.'){
			$rootUploadFolder = $this->uploadFolder;
			while($basedir != '.'){
				$this->setUploadFolder($rootUploadFolder . $basedir);
				$basedir = dirname($basedir);
			}
			$this->uploadFolder = $rootUploadFolder;
		}
/* hack */

		if ( !move_uploaded_file($this->file->tmp, $fileDest))
			if(!JFile::upload($this->file->tmp, $fileDest))
				return false;

		//Protect file against execution
		@chmod($fileDest, JSHOP_UPLOAD_CHMOD_FILE);

		return true;
	}
The following user(s) said Thank You: admin

Please Log in or Create an account to join the conversation.

SECURITY: Missing index.html, on subfolders' path 23 Sep 2013 17:49 #11153

  • admin
  • admin's Avatar
  • Offline
  • Administrator
  • Administrator
  • Chef
  • Posts: 3711
  • Thank you received: 986
Coding is now a piece of cake

Please Log in or Create an account to join the conversation.

  • Page:
  • 1
Time to create page: 0.100 seconds

Awards for the best Joomla app. This product is gonna win an award for this amazing job. Cook Self Service is the the best application from all over the Joomla universe ! It brings Joomla to a professional level really advanced for developers. It is a real fun to develop with it. The ACL part and security checks implementation are just... so much hours saved. I can now concentrate myself more on the design part and the creative works. Thank you so much. Guys I offer you all my congratulation ! Keep up the works because Joomla is needing it to increase the quality of extensions availables on the JED. I also learned a lot because I can see how to code at the proper place and I found all my answers reading the forum.
lack_hanson (JED)
          

Get Started