Re-add writable directory check for target path

pull/701/head
fadrian06 3 days ago committed by GitHub
parent 49b750c329
commit fdb1804862
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

@ -131,14 +131,15 @@ class UploadedFile
throw new Exception($this->getUploadErrorMessage($this->error)); throw new Exception($this->getUploadErrorMessage($this->error));
} }
if (is_writeable(dirname($targetPath)) === false) {
throw new Exception('Target directory is not writable');
}
// Prevent path traversal attacks // Prevent path traversal attacks
if (strpos($targetPath, '..') !== false) { if (strpos($targetPath, '..') !== false) {
throw new Exception('Invalid target path: contains directory traversal'); throw new Exception('Invalid target path: contains directory traversal');
} }
if (is_writeable(dirname($targetPath)) === false) {
throw new Exception('Target directory is not writable');
}
// Prevent absolute paths (basic check for Unix/Windows) // Prevent absolute paths (basic check for Unix/Windows)
if ($targetPath[0] === '/' || (strlen($targetPath) > 1 && $targetPath[1] === ':')) { if ($targetPath[0] === '/' || (strlen($targetPath) > 1 && $targetPath[1] === ':')) {
throw new Exception('Invalid target path: absolute paths not allowed'); throw new Exception('Invalid target path: absolute paths not allowed');

Loading…
Cancel
Save