Bug #82060

File Abstraction Layer: Extract metadata in storage (scheduler) failing on indexing files that matches denied patterns(['BE']['fileDenyPattern'])

Added by Ricky Mathew 15 days ago. Updated 7 days ago.

Status:
New
Priority:
Must have
Assignee:
Category:
scheduler
Start date:
2017-08-09
Due date:
% Done:

0%

TYPO3 Version:
7
PHP Version:
7.1
Tags:
Complexity:
easy
Is Regression:
Sprint Focus:

Description

File Abstraction Layer: Extract metadata in storage (scheduler) fails on trying to index the files in denied pattern(['BE']['fileDenyPattern']) by throwing an exception like following::

_TYPO3\CMS\Core\Resource\Exception\InsufficientFileAccessPermissionsExceptionprototypeobject
message => 'You are not allowed to access that file: "browserdetect.inc.php"' (64 chars)
code => 1375955429 (integer)
_

And my ['BE']['fileDenyPattern'] is "\.(php[3-7]?|phpsh|phtml)(\..*)?$|^\.htaccess$"

We can avoid this by just adding a condition check in runMetaDataExtraction() function in TYPO3\CMS\Core\Resource\Index\Indexer class as follows

$isAllowed = GeneralUtility::verifyFilenameAgainstDenyPattern($indexRecord['name']);

           if($isAllowed){
            $fileObject = $this->getResourceFactory()->getFileObject($indexRecord['uid'], $indexRecord);
            $this->extractMetaData($fileObject);
           }

so can any one please provide a patch with above mentioned solution?

Indexer_patch.patch View (695 Bytes) Ricky Mathew, 2017-08-10 07:31

History

#1 Updated by Ricky Mathew 15 days ago

  • Complexity changed from hard to easy

#2 Updated by Ricky Mathew 15 days ago

The logic is , we need to run the extractMetaData() function only if the file is of allowable type and that is what the condition check will do.

#3 Updated by Ricky Mathew 14 days ago

  • Category set to scheduler
  • Target version set to Candidate for patchlevel

#4 Updated by Ricky Mathew 14 days ago

Attaching the patch file here.

#5 Updated by Ricky Mathew 14 days ago

--- Indexer_orig.php    2017-08-09 16:02:52.912607837 +0530
+++ Indexer.php    2017-08-09 16:10:08.404625955 +0530
@@ -106,8 +106,12 @@
     {
         $fileIndexRecords = $this->getFileIndexRepository()->findInStorageWithIndexOutstanding($this->storage, $maximumFileCount);
         foreach ($fileIndexRecords as $indexRecord) {
+           $isAllowed = GeneralUtility::verifyFilenameAgainstDenyPattern($indexRecord['name']);
+           if ($isAllowed) {
             $fileObject = $this->getResourceFactory()->getFileObject($indexRecord['uid'], $indexRecord);
             $this->extractMetaData($fileObject);
+           }
         }
     }

#6 Updated by Ricky Mathew 14 days ago

  • Assignee set to Ricky Mathew

#7 Updated by Ricky Mathew 7 days ago

As my membership in core project is still pending, can anyone please take this task and apply this patch?

Also available in: Atom PDF