TYPO3 Core

In some situations, ResourceFactory::retrieveFileOrFolderObject($input) wrongly returns a Folder object instead of a File object.

This occured in a composer based installation when $input is anything outside public web path like "var/www/html/var/transient/youtube_1e65d7002154f3586b97bd19d2787829.jpg" (a preview image created by TYPO3\CMS\Core\Resource\OnlineMedia\Helpers\YouTubeHelper).

The wrong check seems to happen in line 485...

$input = PathUtility::getCanonicalPath(ltrim($input, '/'));
if (@is_file(Environment::getPublicPath() . '/' . $input)) {
    // only the local file
    return $this->getFileObjectFromCombinedIdentifier($input);
}
// only the local path
return $this->getFolderObjectFromCombinedIdentifier($input);

It should be easy to reproduce:

• Upload any youtube or vimeo video from backend
• Assign it to any record or model
• In FLUID, let it be rendered using "<f:image>" (when using "image" tag instead of "media" viewhelper, this automatically creates the thumbnail)

This crashes the frontend!

I don't know if this bug is part of ResourceFactory::retrieveFileOrFolderObject() rather than YouTubeHelper::getPreviewImage() (which might create the thumbnail on the wrong location.

Independent from this being related to the "online media stuff", anyway the "retrieveFileOrFolderObject()" must not return a folder object in this case (perhaps better just "false" or throw an exception when neither file nor folder?).