From 0eb2cf18a4e46e0586280e8e0af4d674fef51166 Mon Sep 17 00:00:00 2001 From: lukinovec Date: Wed, 19 Aug 2026 10:35:07 +0200 Subject: [PATCH] Throw an exception in possibleTenantSymlinks if the disk is not tenant-aware When a disk in url_override and root_override is absent from tenancy.filesystem.disks, FilesystemTenancyBootstrapper leaves its root unchanged, possibleTenantSymlinks allows creating a symlink for that unscoped disk (= a disk with a central root), which can expose shared files. Fixed by throwing an exception in possibleTenantSymlinks saying that the disk should be tenant-aware (= included in the tenancy.filesystem.disks config). --- src/Concerns/DealsWithTenantSymlinks.php | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/Concerns/DealsWithTenantSymlinks.php b/src/Concerns/DealsWithTenantSymlinks.php index 479db163..6ab4efc0 100644 --- a/src/Concerns/DealsWithTenantSymlinks.php +++ b/src/Concerns/DealsWithTenantSymlinks.php @@ -50,6 +50,12 @@ trait DealsWithTenantSymlinks throw new Exception("Disk $disk is not a local disk. Only local disks can be symlinked."); } + if (! in_array($disk, config('tenancy.filesystem.disks'), true)) { + // The bootstrapper only scopes disks listed in tenancy.filesystem.disks. Without that, + // the disk root stays central, and the symlink of every tenant would point to it. + throw new Exception("Disk $disk is not tenant-aware. Add it to the tenancy.filesystem.disks config to make its root tenant-specific."); + } + $publicPath = str_replace('%tenant%', (string) $tenantKey, $publicPath); $symlinks[public_path($publicPath)] = $tenantDisks[$disk]['root'];