Project

General

Profile

Actions

Bug #78737

closed

TCA select fileFolder scans whole filesystem upon invalid given path

Added by Anja Leichsenring about 8 years ago. Updated about 6 years ago.

Status:
Closed
Priority:
Should have
Category:
-
Target version:
-
Start date:
2016-11-17
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
8
PHP Version:
Tags:
Complexity:
Is Regression:
No
Sprint Focus:

Description

I just managed to make TYPO3 scan my complete file system for icons to include into a select field. -.-

Situation:

 'field' => [
            'config' => [
                'type' => 'select',
                'renderType' => 'selectSingle',
                'maxitems' => 1,
                'items' => [
                    ['', 0],
                ],
                'fileFolder' => 'EXT:my_ext/Resources/Public/Icons/',
                'fileFolder_extList' => 'svg',
                'fileFolder_recursions' => 0,
            ],
        ],

Resulting in the exception: #1476107295: PHP Warning: scandir(/boot/efi): failed to open dir: Permission denied in ....

In fact, nothing bad happened, thanks to the permission violation, but still this is not really helpful to find the source of the error.

The problem is a missing check in sysext/backend/Classes/Form/FormDataProvider/AbstractItemProvider.php line 372, where a / is addad after an rtrim on the filepath, might it be empty or not.

Actions

Also available in: Atom PDF