Project

General

Profile

Actions

Bug #83762

closed

File storage with invalid (upwards folder "../") path can be saved as 'absolute path', but then not edited anymore due to error message. Unsolvable situation.

Added by Leonie Philine about 6 years ago. Updated over 5 years ago.

Status:
Closed
Priority:
Must have
Assignee:
-
Category:
File Abstraction Layer (FAL)
Target version:
Start date:
2018-02-02
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
8
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

Using TYPO3 8.7 LTS.

- I edited a file storage with absolute path.
- changed path to relative.
- entered "../somefolder" for a folder outside the web root.
- saved the file storage
- an error occurs: "File ../somefolder is not valid (".." and "//" is not allowed in path). "
- went back to the list module
- clicked to edit the file storage
- same error appears again -> there is no way to get to see the editing form for this record again!

-> file storage was saved with invalid path ==> fatally missing validation before saving!

-> now I cannot fix the invalid path, because the error is shown instead of the record editing form for the file storage.

-> hopeless situation, only direct DB access can come to the rescue.

Actions #1

Updated by Leonie Philine about 6 years ago

  • Subject changed from File storage with invalid (upwards folder "../") path can be saved, but then not edited anymore due to error message. Unsolvable situation. to File storage with invalid (upwards folder "../") path can be saved as 'absolute path', but then not edited anymore due to error message. Unsolvable situation.

PS: When I checked the database record, the path type was saved as 'absolute'. I had initially thought I changed it to relative. (Maybe TYPO3 did not save the change from absolute to relative, but I cannot reproduce that, so I can only assume right now that I missed changing it to 'relative'.)

So, if you configure a record to have an ABSOLUTE path and enter a path containing "../", then the record will no longer be editable.

Actions #2

Updated by Gerrit Code Review about 6 years ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55551

Actions #3

Updated by Gerrit Code Review about 6 years ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55551

Actions #4

Updated by Gerrit Code Review about 6 years ago

Patch set 1 for branch TYPO3_8-7 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55552

Actions #5

Updated by Anonymous about 6 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
Actions #6

Updated by Gerrit Code Review about 6 years ago

  • Status changed from Resolved to Under Review

Patch set 2 for branch TYPO3_8-7 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55552

Actions #7

Updated by Anonymous about 6 years ago

  • Status changed from Under Review to Resolved
Actions #8

Updated by Benni Mack over 5 years ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF