TYPO3 Core

Analyse¶

Problem is that a call to ->getParentFolder() will call in turn \TYPO3\CMS\Core\Resource\ResourceStorage::assureFolderReadPermission on it and this is why it crashes!

I think we should go for:

    public function getReadablePath($rootId = NULL) {
        $oldPermissionFlag = $this->getStorage()->getEvaluatePermissions();
        $this->getStorage()->setEvaluatePermissions(FALSE);
        if ($rootId === NULL) {
            $rootId = $this->storage->getRootLevelFolder()->getIdentifier();
        }
        $readablePath = '';
        if ($this->identifier !== $rootId) {
            $readablePath = $this->getParentFolder()->getReadablePath($rootId);
        }
        $this->getStorage()->setEvaluatePermissions($oldPermissionFlag);
        return $readablePath . $this->name . '/';
    }

As information disclosure (naming of the full path) was no issue prior to the change, the temporary disabling of the permissions check isn't an issue.

Will provide a patch tomorrow is not done by someone else already

ok, issue is

if ($rootId === NULL) {
            $rootId = $this->storage->getRootLevelFolder()->getIdentifier();
        }

and not the permissions part. getRootLevelFolder() returns the first readable mount point instead "current" mount point.

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/39767

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/39767

Patch set 1 for branch TYPO3_6-2 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/39787