User tests: Successful: Unsuccessful:
Pull Request for Issue ##24539 and #24723 .
Fix directory and file traversal/creation/deletion in com_media for a symlinked "images" folder.
See original bug submission at #24539, PR #24723 by @smehrbrodt and extra analysis by @HLeithner .
Please note that the #24723 changes are included in this PR although not via a merge that shows history (simply copy/paste of the diffed line).
Have the /images directory as a symlink that points outside the J installation folder. In my test case it points to ../images
1.Through the back-end mediamanager (/administrator/index.php?option=com_media&folder=), try to navigate to a subdirectory by clicking on the subdirectory icon.
2. Through the back-end mediamanager (/administrator/index.php?option=com_media&folder=), try to upload an image by clicking the "+Upload" button in the toolbar.
3. Through the back-end mediamanager (/administrator/index.php?option=com_media&folder=), try to delete an image by clicking the "X" icon at the top-left of a listed image.
4. Through the back-end mediamanager (/administrator/index.php?option=com_media&folder=), try to create a new directory by clicking the "Create New Folder" button in the toolbar.
5. Through the back-end mediamanager (/administrator/index.php?option=com_media&folder=), try to delete a directory by clicking the "X" icon at the top-right of the folder icon.
6. While in the back-end editing an article with TinyMCE (/administrator/index.php?option=com_content&view=article&layout=edit), drag&drop an image from your OS file manager in the content editing area
None
Status | New | ⇒ | Pending |
Category | ⇒ | Administration com_media |
Labels |
Added:
?
|
No, unfortunately this is only going to work for the upper images (e.g COM_MEDIA base) dir.
As discussed in #24539 that'd need something different than realpath() to perform the path checks, and the proposed alternative/code was met with some resistance over "over-engineering".
I'd be happy to go down that path, but I fear that PR would be in danger getting rejected.
I've tested this and I'm fine with it as it solves my immediate problem. I understand that there remain edge cases which are not solved but, in my opinion, those can be solved by a later patch (if at all).
@okonomiyaki3000 can you please mark your test as successfully at Issue Tracker?
@franz-wohlkoenig is there any link to issue tracker around here?
I have tested this item
I have tested this item
Status | Pending | ⇒ | Ready to Commit |
Status "Ready To Commit".
Labels |
Added:
?
|
thx
Status | Ready to Commit | ⇒ | Fixed in Code Base |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2019-06-05 15:18:57 |
Closed_By | ⇒ | HLeithner |
Can the fix also work for a symlinked sub-folder in Joomla installation's 'images' folder?
( J-installation/images/media --symlink--> /media )
This case is a bit different from the test scenario.
Thanks.