fix: Failed asserting that exception message 'Target directory is not writable' contains 'Invalid target path: contains directory traversal'.

pull/702/head
fadrian06 3 days ago
parent 9afa64eb97
commit a1faf4f00b

@ -131,14 +131,15 @@ class UploadedFile
throw new Exception($this->getUploadErrorMessage($this->error)); throw new Exception($this->getUploadErrorMessage($this->error));
} }
if (is_writeable(dirname($targetPath)) === false) {
throw new Exception('Target directory is not writable');
}
// Prevent path traversal attacks // Prevent path traversal attacks
if (strpos($targetPath, '..') !== false) { if (strpos($targetPath, '..') !== false) {
throw new Exception('Invalid target path: contains directory traversal'); throw new Exception('Invalid target path: contains directory traversal');
} }
if (is_writeable(dirname($targetPath)) === false) {
throw new Exception('Target directory is not writable');
}
// Prevent absolute paths (basic check for Unix/Windows) // Prevent absolute paths (basic check for Unix/Windows)
if ($targetPath[0] === '/' || (strlen($targetPath) > 1 && $targetPath[1] === ':')) { if ($targetPath[0] === '/' || (strlen($targetPath) > 1 && $targetPath[1] === ':')) {
throw new Exception('Invalid target path: absolute paths not allowed'); throw new Exception('Invalid target path: absolute paths not allowed');

Loading…
Cancel
Save