Skip to content

Commit c642334

Browse files
mohammedsalemmohammedsalem
authored
Merge branch '2.3-develop' into 3rd-party-dependency
2 parents 50c16e0 + 726a5c9 commit c642334

File tree

28 files changed

+1216
-79
lines changed

28 files changed

+1216
-79
lines changed

‎app/code/Magento/Cms/Controller/Adminhtml/Wysiwyg/Images/DeleteFiles.php‎

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@
77

88
use Magento\Framework\App\Filesystem\DirectoryList;
99

10+
/**
11+
* Delete image files.
12+
*/
1013
class DeleteFiles extends \Magento\Cms\Controller\Adminhtml\Wysiwyg\Images
1114
{
1215
/**
@@ -19,29 +22,40 @@ class DeleteFiles extends \Magento\Cms\Controller\Adminhtml\Wysiwyg\Images
1922
*/
2023
protected $resultRawFactory;
2124

25+
/**
26+
* @var \Magento\Framework\App\Filesystem\DirectoryResolver
27+
*/
28+
private $directoryResolver;
29+
2230
/**
2331
* Constructor
2432
*
2533
* @param \Magento\Backend\App\Action\Context $context
2634
* @param \Magento\Framework\Registry $coreRegistry
2735
* @param \Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory
2836
* @param \Magento\Framework\Controller\Result\RawFactory $resultRawFactory
37+
* @param \Magento\Framework\App\Filesystem\DirectoryResolver|null $directoryResolver
2938
*/
3039
public function __construct(
3140
\Magento\Backend\App\Action\Context $context,
3241
\Magento\Framework\Registry $coreRegistry,
3342
\Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory,
34-
\Magento\Framework\Controller\Result\RawFactory $resultRawFactory
43+
\Magento\Framework\Controller\Result\RawFactory $resultRawFactory,
44+
\Magento\Framework\App\Filesystem\DirectoryResolver $directoryResolver = null
3545
) {
46+
parent::__construct($context, $coreRegistry);
47+
3648
$this->resultRawFactory = $resultRawFactory;
3749
$this->resultJsonFactory = $resultJsonFactory;
38-
parent::__construct($context, $coreRegistry);
50+
$this->directoryResolver = $directoryResolver
51+
?: $this->_objectManager->get(\Magento\Framework\App\Filesystem\DirectoryResolver::class);
3952
}
4053

4154
/**
42-
* Delete file from media storage
55+
* Delete file from media storage.
4356
*
4457
* @return \Magento\Framework\Controller\ResultInterface
58+
* @throws \Magento\Framework\Exception\LocalizedException
4559
*/
4660
public function execute()
4761
{
@@ -54,6 +68,11 @@ public function execute()
5468
/** @var $helper \Magento\Cms\Helper\Wysiwyg\Images */
5569
$helper = $this->_objectManager->get(\Magento\Cms\Helper\Wysiwyg\Images::class);
5670
$path = $this->getStorage()->getSession()->getCurrentPath();
71+
if (!$this->directoryResolver->validatePath($path, DirectoryList::MEDIA)) {
72+
throw new \Magento\Framework\Exception\LocalizedException(
73+
__('Directory %1 is not under storage root path.', $path)
74+
);
75+
}
5776
foreach ($files as $file) {
5877
$file = $helper->idDecode($file);
5978
/** @var \Magento\Framework\Filesystem $filesystem */
@@ -64,11 +83,13 @@ public function execute()
6483
$this->getStorage()->deleteFile($filePath);
6584
}
6685
}
86+
6787
return $this->resultRawFactory->create();
6888
} catch (\Exception $e) {
6989
$result = ['error' => true, 'message' => $e->getMessage()];
7090
/** @var \Magento\Framework\Controller\Result\Json $resultJson */
7191
$resultJson = $this->resultJsonFactory->create();
92+
7293
return $resultJson->setData($result);
7394
}
7495
}

‎app/code/Magento/Cms/Controller/Adminhtml/Wysiwyg/Images/DeleteFolder.php‎

Lines changed: 25 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,11 @@
66
*/
77
namespace Magento\Cms\Controller\Adminhtml\Wysiwyg\Images;
88

9+
use Magento\Framework\App\Filesystem\DirectoryList;
10+
11+
/**
12+
* Delete image folder.
13+
*/
914
class DeleteFolder extends \Magento\Cms\Controller\Adminhtml\Wysiwyg\Images
1015
{
1116
/**
@@ -18,38 +23,55 @@ class DeleteFolder extends \Magento\Cms\Controller\Adminhtml\Wysiwyg\Images
1823
*/
1924
protected $resultRawFactory;
2025

26+
/**
27+
* @var \Magento\Framework\App\Filesystem\DirectoryResolver
28+
*/
29+
private $directoryResolver;
30+
2131
/**
2232
* @param \Magento\Backend\App\Action\Context $context
2333
* @param \Magento\Framework\Registry $coreRegistry
2434
* @param \Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory
2535
* @param \Magento\Framework\Controller\Result\RawFactory $resultRawFactory
36+
* @param \Magento\Framework\App\Filesystem\DirectoryResolver|null $directoryResolver
2637
*/
2738
public function __construct(
2839
\Magento\Backend\App\Action\Context $context,
2940
\Magento\Framework\Registry $coreRegistry,
3041
\Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory,
31-
\Magento\Framework\Controller\Result\RawFactory $resultRawFactory
42+
\Magento\Framework\Controller\Result\RawFactory $resultRawFactory,
43+
\Magento\Framework\App\Filesystem\DirectoryResolver $directoryResolver = null
3244
) {
45+
parent::__construct($context, $coreRegistry);
3346
$this->resultRawFactory = $resultRawFactory;
3447
$this->resultJsonFactory = $resultJsonFactory;
35-
parent::__construct($context, $coreRegistry);
48+
$this->directoryResolver = $directoryResolver
49+
?: $this->_objectManager->get(\Magento\Framework\App\Filesystem\DirectoryResolver::class);
3650
}
3751

3852
/**
39-
* Delete folder action
53+
* Delete folder action.
4054
*
4155
* @return \Magento\Framework\Controller\ResultInterface
56+
* @throws \Magento\Framework\Exception\LocalizedException
4257
*/
4358
public function execute()
4459
{
4560
try {
4661
$path = $this->getStorage()->getCmsWysiwygImages()->getCurrentPath();
62+
if (!$this->directoryResolver->validatePath($path, DirectoryList::MEDIA)) {
63+
throw new \Magento\Framework\Exception\LocalizedException(
64+
__('Directory %1 is not under storage root path.', $path)
65+
);
66+
}
4767
$this->getStorage()->deleteDirectory($path);
68+
4869
return $this->resultRawFactory->create();
4970
} catch (\Exception $e) {
5071
$result = ['error' => true, 'message' => $e->getMessage()];
5172
/** @var \Magento\Framework\Controller\Result\Json $resultJson */
5273
$resultJson = $this->resultJsonFactory->create();
74+
5375
return $resultJson->setData($result);
5476
}
5577
}

‎app/code/Magento/Cms/Controller/Adminhtml/Wysiwyg/Images/NewFolder.php‎

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,44 +6,65 @@
66
*/
77
namespace Magento\Cms\Controller\Adminhtml\Wysiwyg\Images;
88

9+
use Magento\Framework\App\Filesystem\DirectoryList;
10+
11+
/**
12+
* Creates new folder.
13+
*/
914
class NewFolder extends \Magento\Cms\Controller\Adminhtml\Wysiwyg\Images
1015
{
1116
/**
1217
* @var \Magento\Framework\Controller\Result\JsonFactory
1318
*/
1419
protected $resultJsonFactory;
1520

21+
/**
22+
* @var \Magento\Framework\App\Filesystem\DirectoryResolver
23+
*/
24+
private $directoryResolver;
25+
1626
/**
1727
* @param \Magento\Backend\App\Action\Context $context
1828
* @param \Magento\Framework\Registry $coreRegistry
1929
* @param \Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory
30+
* @param \Magento\Framework\App\Filesystem\DirectoryResolver|null $directoryResolver
2031
*/
2132
public function __construct(
2233
\Magento\Backend\App\Action\Context $context,
2334
\Magento\Framework\Registry $coreRegistry,
24-
\Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory
35+
\Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory,
36+
\Magento\Framework\App\Filesystem\DirectoryResolver $directoryResolver = null
2537
) {
26-
$this->resultJsonFactory = $resultJsonFactory;
2738
parent::__construct($context, $coreRegistry);
39+
$this->resultJsonFactory = $resultJsonFactory;
40+
$this->directoryResolver = $directoryResolver
41+
?: $this->_objectManager->get(\Magento\Framework\App\Filesystem\DirectoryResolver::class);
2842
}
2943

3044
/**
31-
* New folder action
45+
* New folder action.
3246
*
3347
* @return \Magento\Framework\Controller\ResultInterface
48+
* @throws \Magento\Framework\Exception\LocalizedException
3449
*/
3550
public function execute()
3651
{
3752
try {
3853
$this->_initAction();
3954
$name = $this->getRequest()->getPost('name');
4055
$path = $this->getStorage()->getSession()->getCurrentPath();
56+
if (!$this->directoryResolver->validatePath($path, DirectoryList::MEDIA)) {
57+
throw new \Magento\Framework\Exception\LocalizedException(
58+
__('Directory %1 is not under storage root path.', $path)
59+
);
60+
}
4161
$result = $this->getStorage()->createDirectory($name, $path);
4262
} catch (\Exception $e) {
4363
$result = ['error' => true, 'message' => $e->getMessage()];
4464
}
4565
/** @var \Magento\Framework\Controller\Result\Json $resultJson */
4666
$resultJson = $this->resultJsonFactory->create();
67+
4768
return $resultJson->setData($result);
4869
}
4970
}

‎app/code/Magento/Cms/Controller/Adminhtml/Wysiwyg/Images/Upload.php‎

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,43 +6,64 @@
66
*/
77
namespace Magento\Cms\Controller\Adminhtml\Wysiwyg\Images;
88

9+
use Magento\Framework\App\Filesystem\DirectoryList;
10+
11+
/**
12+
* Upload image.
13+
*/
914
class Upload extends \Magento\Cms\Controller\Adminhtml\Wysiwyg\Images
1015
{
1116
/**
1217
* @var \Magento\Framework\Controller\Result\JsonFactory
1318
*/
1419
protected $resultJsonFactory;
1520

21+
/**
22+
* @var \Magento\Framework\App\Filesystem\DirectoryResolver
23+
*/
24+
private $directoryResolver;
25+
1626
/**
1727
* @param \Magento\Backend\App\Action\Context $context
1828
* @param \Magento\Framework\Registry $coreRegistry
1929
* @param \Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory
30+
* @param \Magento\Framework\App\Filesystem\DirectoryResolver|null $directoryResolver
2031
*/
2132
public function __construct(
2233
\Magento\Backend\App\Action\Context $context,
2334
\Magento\Framework\Registry $coreRegistry,
24-
\Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory
35+
\Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory,
36+
\Magento\Framework\App\Filesystem\DirectoryResolver $directoryResolver = null
2537
) {
26-
$this->resultJsonFactory = $resultJsonFactory;
2738
parent::__construct($context, $coreRegistry);
39+
$this->resultJsonFactory = $resultJsonFactory;
40+
$this->directoryResolver = $directoryResolver
41+
?: $this->_objectManager->get(\Magento\Framework\App\Filesystem\DirectoryResolver::class);
2842
}
2943

3044
/**
31-
* Files upload processing
45+
* Files upload processing.
3246
*
3347
* @return \Magento\Framework\Controller\ResultInterface
48+
* @throws \Magento\Framework\Exception\LocalizedException
3449
*/
3550
public function execute()
3651
{
3752
try {
3853
$this->_initAction();
39-
$targetPath = $this->getStorage()->getSession()->getCurrentPath();
40-
$result = $this->getStorage()->uploadFile($targetPath, $this->getRequest()->getParam('type'));
54+
$path = $this->getStorage()->getSession()->getCurrentPath();
55+
if (!$this->directoryResolver->validatePath($path, DirectoryList::MEDIA)) {
56+
throw new \Magento\Framework\Exception\LocalizedException(
57+
__('Directory %1 is not under storage root path.', $path)
58+
);
59+
}
60+
$result = $this->getStorage()->uploadFile($path, $this->getRequest()->getParam('type'));
4161
} catch (\Exception $e) {
4262
$result = ['error' => $e->getMessage(), 'errorcode' => $e->getCode()];
4363
}
4464
/** @var \Magento\Framework\Controller\Result\Json $resultJson */
4565
$resultJson = $this->resultJsonFactory->create();
66+
4667
return $resultJson->setData($result);
4768
}
4869
}

‎app/code/Magento/Cms/Helper/Wysiwyg/Images.php‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,9 @@
88
use Magento\Framework\App\Filesystem\DirectoryList;
99

1010
/**
11-
* Wysiwyg Images Helper
11+
* Wysiwyg Images Helper.
12+
*
13+
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
1214
*/
1315
class Images extends \Magento\Framework\App\Helper\AbstractHelper
1416
{
@@ -156,17 +158,23 @@ public function convertPathToId($path)
156158
}
157159

158160
/**
159-
* Decode HTML element id
161+
* Decode HTML element id.
160162
*
161163
* @param string $id
162164
* @return string
165+
* @throws \InvalidArgumentException When path contains restricted symbols.
163166
*/
164167
public function convertIdToPath($id)
165168
{
166169
if ($id === \Magento\Theme\Helper\Storage::NODE_ROOT) {
167170
return $this->getStorageRoot();
168171
} else {
169-
return $this->getStorageRoot() . $this->idDecode($id);
172+
$path = $this->getStorageRoot() . $this->idDecode($id);
173+
if (preg_match('/\.\.(\\\|\/)/', $path)) {
174+
throw new \InvalidArgumentException('Path is invalid');
175+
}
176+
177+
return $path;
170178
}
171179
}
172180

0 commit comments

Comments
 (0)