Project

General

Profile

Bug #93823

Updated by Jan Kornblum over 3 years ago

In some situations, ResourceFactory::retrieveFileOrFolderObject($input) wrongly returns a Folder object instead of a File object. 

 This occured in a composer based installation when $input is anything outside public web path like "var/www/html/var/transient/youtube_1e65d7002154f3586b97bd19d2787829.jpg" (a preview image created by TYPO3\CMS\Core\Resource\OnlineMedia\Helpers\YouTubeHelper). 

 The wrong check seems to happen in line 485... 


 <pre><code class="php"> 
 $input = PathUtility::getCanonicalPath(ltrim($input, '/')); 
 if (@is_file(Environment::getPublicPath() . '/' . $input)) { 
	 // only the local file 
	 return $this->getFileObjectFromCombinedIdentifier($input); 
 } 
 // only the local path 
 return $this->getFolderObjectFromCombinedIdentifier($input);</code></pre> 

 It should be easy to reproduce: 

 * Upload any and youtube or vimeo video from backend 
 * Assign it to any record or model 
 * In FLUID, let it be rendered using "<f:image>" (when using "image" tag instead of "media" viewhelper, this automatically creates the thumbnail) 

 This crashes the frontend! 

 I don't know if this bug is part of ResourceFactory::retrieveFileOrFolderObject() rather than YouTubeHelper::getPreviewImage() (which might create the thumbnail on the wrong location.

Back