archtechx/tenancy
1
0
Fork 0
mirror of https://github.com/archtechx/tenancy.git synced 2026-09-20 11:14:03 +00:00
Code Activity

Require a directory boundary when checking that an asset is inside the asset root

Browse source 
The resolved path was compared to the asset root using a plain string prefix, so a
directory whose name just starts with the asset root's name passed the check. This
didn't matter while the asset root was hardcoded to app/public, but $publicDisk lets
it be any disk root.
This commit is contained in:
lukinovec 2026-08-18 17:14:42 +02:00 • committed by Samuel Stancl
parent ff3a2a3e2c
commit 4e1fb850bc
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/Controllers/TenantAssetController.php
View file

@ -112,8 +112,10 @@ class TenantAssetController implements HasMiddleware
// User is attempting to access a nonexistent file
$this->abortIf($attemptedPath === false, 'Accessing a nonexistent file');
// User is attempting to access a file outside the $allowedRoot folder
$this->abortIf(! str($attemptedPath)->startsWith($allowedRoot), 'Accessing a file outside the storage root');
// User is attempting to access a file outside the $allowedRoot folder.
// The trailing separator is needed so that sibling directories that
// start with the same name (e.g. app/public-private) don't pass.
$this->abortIf(! str($attemptedPath)->startsWith(rtrim($allowedRoot, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR), 'Accessing a file outside the storage root');
}
/** @return void|never */