adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2024-11-15 03:18:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #5905 from davidsteinsland/fix_file_response_dots

Browse source 
Fix file response dots
This commit is contained in:
Mark Story 2015-03-09 21:54:02 -04:00
commit 43f16f38f0
2 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/Cake/Network/CakeResponse.php
View file

@ -1336,7 +1336,7 @@ class CakeResponse {
'download' => null
);
if (strpos($path, '..') !== false) {
if (strpos($path, '../') !== false || strpos($path, '..\\') !== false) {
throw new NotFoundException(__d(
'cake_dev',
'The requested file contains `..` and will not be read.'

14
lib/Cake/Test/Case/Network/CakeResponseTest.php
View file

@ -1170,6 +1170,7 @@ class CakeResponseTest extends CakeTestCase {
* test file with ..
*
* @expectedException NotFoundException
* @expectedExceptionMessage The requested file contains `..` and will not be read.
* @return void
*/
public function testFileWithPathTraversal() {
@ -1177,6 +1178,19 @@ class CakeResponseTest extends CakeTestCase {
$response->file('my/../cat.gif');
}
/**
* Although unlikely, a file may contain dots in its filename.
* This should be allowed, as long as the dots doesn't specify a path (../ or ..\)
*
* @expectedException NotFoundException
* @execptedExceptionMessageRegExp #The requested file .+my/Some..cat.gif was not found or not readable#
* @return void
*/
public function testFileWithDotsInFilename() {
$response = new CakeResponse();
$response->file('my/Some..cat.gif');
}
/**
* testFile method
*