adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2025-01-31 09:06:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixed downloading of files with dots

Browse source
This commit is contained in:
David Steinsland 2015-02-15 19:32:33 +01:00
parent 10b6ba7dc2
commit 5fd7396e47
2 changed files with 20 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/Cake/Network/CakeResponse.php
View file

@ -1336,7 +1336,7 @@ class CakeResponse {
'download' => null
);
if (strpos($path, '..') !== false) {
if (strpos($path, '../') !== false || strpos($path, '..\\') !== false) {
throw new NotFoundException(__d(
'cake_dev',
'The requested file contains `..` and will not be read.'

19
lib/Cake/Test/Case/Network/CakeResponseTest.php
View file

@ -1170,6 +1170,7 @@ class CakeResponseTest extends CakeTestCase {
* test file with ..
*
* @expectedException NotFoundException
* @expectedExceptionMessage The requested file contains `..` and will not be read.
* @return void
*/
public function testFileWithPathTraversal() {
@ -1177,6 +1178,24 @@ class CakeResponseTest extends CakeTestCase {
$response->file('my/../cat.gif');
}
public function testFileWithDotsInFilename() {
$ok = false;
$file = 'my/Some..cat.gif';
try {
$response = new CakeResponse();
$response->file($file);
} catch (NotFoundException $e) {
if (Configure::read('debug') > 0) {
$ok = $e->getMessage() === sprintf('The requested file %s was not found or not readable', APP . $file);
} else {
$ok = $e->getMessage() === 'The requested file was not found';
}
}
$this->assertTrue($ok);
}
/**
* testFile method
*