archtechx/tenancy
1
0
Fork 0
mirror of https://github.com/archtechx/tenancy.git synced 2026-09-20 15:14:03 +00:00
Code Activity

Forget scoped disk's parent no matter how nested it is

Browse source 
This includes moving the TenantAssetController baseDiskName() method to FSBootstrapper and making it public static, since the same logic is used in two places now. Also cover the edge case where a scoped disk A has a scoped disk B as its parent, and B has A as its parent -- in that case, the method would be stuck in an infinite loop (also added separate test for this, commenting out the $visited-related code in baseDiskName will make the test fail).

Also updated the assetRoot's unnamed disk exception message.
This commit is contained in:
lukinovec 2026-09-03 16:16:27 +02:00 • committed by Samuel Stancl
parent e20085588b
commit 9cda4cb3e4
4 changed files with 63 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

26
src/Controllers/TenantAssetController.php
View file

@ -102,7 +102,11 @@ class TenantAssetController implements HasMiddleware
throw new Exception('Disk [' . static::$publicDisk . '] is not a local disk. Only local disks can be used for serving assets.');
}
$baseDiskName = $this->baseDiskName(static::$publicDisk);
$baseDiskName = FilesystemTenancyBootstrapper::baseDiskName(static::$publicDisk);
if ($baseDiskName === null) {
throw new Exception('Disk [' . static::$publicDisk . '] has an unnamed parent disk. Use a named parent disk listed in tenancy.filesystem.disks.');
}
if (! in_array($baseDiskName, config('tenancy.filesystem.disks'), true)) {
// FilesystemTenancyBootstrapper only scopes the roots of disks listed in tenancy.filesystem.disks.
@ -123,26 +127,6 @@ class TenantAssetController implements HasMiddleware
return storage_path('app/public');
}
/**
* Name of the disk whose root the passed disk uses.
*
* Disks using the 'scoped' driver have no root of their own -- they inherit the root of their parent disk,
* which can be scoped as well, so the final/base parent is what has to be tenant-aware.
*/
protected function baseDiskName(string $disk): string
{
while (config("filesystems.disks.$disk.driver") === 'scoped') {
if (! is_string($parent = config("filesystems.disks.$disk.disk"))) {
// Laravel allows configuring the parent inline as an array, in which case it has no name
throw new Exception("Disk [$disk] has its parent disk configured inline. Use a named parent disk listed in tenancy.filesystem.disks.");
}
$disk = $parent;
}
return $disk;
}
/**
* Prevent path traversal attacks. This is generally a non-issue on modern
* webservers but it's still worth handling on the application level as well.