? streamwrapper-D7-8.patch ? streamwrapper-D7-9.patch ? modules/simpletest/tests/file-streamwrapper-tests ? sites/chsc-drupal.dev.peytz.dk Index: includes/file.inc =================================================================== RCS file: /cvs/drupal/drupal/includes/file.inc,v retrieving revision 1.133 diff -u -9 -p -r1.133 file.inc --- includes/file.inc 17 Sep 2008 07:11:56 -0000 1.133 +++ includes/file.inc 18 Sep 2008 22:07:30 -0000 @@ -79,18 +79,69 @@ define('FILE_STATUS_TEMPORARY', 0); * File status -- File has been permanently saved to the {files} tables. * * If you wish to add custom statuses for use by contrib modules please expand * as binary flags and consider the first 8 bits reserved. * (0,1,2,4,8,16,32,64,128). */ define('FILE_STATUS_PERMANENT', 1); /** + * Get canonicalized absolute path of a file or directory. The Windows path + * separator "\" is converted to "/", and consecutive "/" characters are stripped. + * If path is a directory, the trailing "/" is stripped. + * For regular files: + * - Symbolic links are expanded. + * - "/./" and "/../" segments are resolved. + * For paths with protocol/wrapper prefix (e.g. "mywrapper://foo/bar.txt"): + * - Paths containing "/../" are blocked (FALSE is returned). + * - Paths are assumed to be case-sensitive (no case normalization is done). + * + * @code + * // Returns "/foo/bar/boo", or FALSE if the file does not exist: + * file_realpath('/foo//bar/./baz/..\\boo'); + * + * // Returns FALSE due to "/../": + * file_realpath('mywrapper://foo/bar/../baz'); + * @endcode + * + * @param $path A string containing a path to a file or directory. + * @return A string containing the absolute path to the file/directory, + * or FALSE if file/directory does not exist. + */ +function file_realpath($path) { + // Does $path include an explicit protocol/wrapper prefix "foo://" (not a + // Windows drive letter "C:/temp")? + if (preg_match('@^([a-z0-9.+-]{2,})://(.*)@i', $path, $reg)) { + // Replace "\" and "//" with "/", except when "//" is preceded by a colon + // (this indicates a nested stream wrapper prefix, e.g. "foo://bar://". + $wrappedPath = preg_replace('@(? $directory))); watchdog('file system', 'The directory %directory does not exist.', array('%directory' => $directory), WATCHDOG_ERROR); } return FALSE; } @@ -178,19 +229,19 @@ function file_check_directory(&$director } return FALSE; } } if ((file_directory_path() == $directory || file_directory_temp() == $directory) && !is_file("$directory/.htaccess")) { $htaccess_lines = "SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006\nOptions None\nOptions +FollowSymLinks"; if (($fp = fopen("$directory/.htaccess", 'w')) && fputs($fp, $htaccess_lines)) { fclose($fp); - chmod($directory . '/.htaccess', 0664); + @chmod($directory . '/.htaccess', 0664); } else { $variables = array('%directory' => $directory, '!htaccess' => '
' . nl2br(check_plain($htaccess_lines))); form_set_error($form_item, t("Security warning: Couldn't write .htaccess file. Please create a .htaccess file in your %directory directory which contains the following lines: !htaccess", $variables)); watchdog('security', "Security warning: Couldn't write .htaccess file. Please create a .htaccess file in your %directory directory which contains the following lines: !htaccess", $variables, WATCHDOG_ERROR); } } return TRUE; @@ -232,27 +283,31 @@ function file_check_path(&$path) { * file_check_location('/www/example.com/files/../../../etc/passwd', '/www/example.com/files'); * @endcode * * @param $source A string set to the file to check. * @param $directory A string where the file should be located. * @return FALSE if the path does not exist in the directory; * otherwise, the real path of the source. */ function file_check_location($source, $directory = '') { - $check = realpath($source); + $check = file_realpath($source); if ($check) { $source = $check; } else { + $basename = basename($source); + if ($basename == '..') { + return FALSE; + } // This file does not yet exist. - $source = realpath(dirname($source)) . '/' . basename($source); + $source = file_realpath(dirname($source)) . '/' . $basename; } - $directory = realpath($directory); + $directory = file_realpath($directory); if ($directory && strpos($source, $directory) !== 0) { return FALSE; } return $source; } /** * Copy a file to a new location. * @@ -273,19 +328,19 @@ function file_check_location($source, $d * Replace behavior when the destination file already exists: * - FILE_EXISTS_REPLACE - Replace the existing file. * - FILE_EXISTS_RENAME - Append _{incrementing number} until the filename is * unique. * - FILE_EXISTS_ERROR - Do nothing and return FALSE. * @return * The path to the new file, or FALSE in the event of an error. */ function file_copy($source, $destination = NULL, $replace = FILE_EXISTS_RENAME) { - $source = realpath($source); + $source = file_realpath($source); if (!file_exists($source)) { drupal_set_message(t('The specified file %file could not be copied, because no file by that name exists. Please check that you supplied the correct filename.', array('%file' => $source)), 'error'); return FALSE; } $destination = file_create_path($destination); $directory = $destination; $basename = file_check_path($directory); @@ -301,19 +356,19 @@ function file_copy($source, $destination $destination = file_destination($directory . '/' . $basename, $replace); if ($destination === FALSE) { drupal_set_message(t('The specified file %file could not be copied because a file by that name already exists in the destination.', array('%file' => $source)), 'error'); return FALSE; } // Make sure source and destination filenames are not the same, makes no // sense to copy it if they are. In fact copying the file will most likely // result in a 0 byte file. Which is bad. Real bad. - if ($source == realpath($destination)) { + if ($source == file_realpath($destination)) { drupal_set_message(t('The specified file %file was not copied because it would overwrite itself.', array('%file' => $source)), 'error'); return FALSE; } if (!@copy($source, $destination)) { drupal_set_message(t('The specified file %file could not be copied.', array('%file' => $source)), 'error'); return FALSE; } // Give everyone read access so that FTP'd users or @@ -1016,19 +1071,22 @@ function file_scan_directory($dir, $mask } closedir($handle); } return $files; } /** - * Determine the default temporary directory. + * Determine the default temporary directory. This may be used for storing + * temporary files within a single request. + * If a temporary file is to be used in several requests, it should be saved in + * file_directory_path with its status set to FILE_STATUS_TEMPORARY. * * @return A string containing a temp directory. */ function file_directory_temp() { $temporary_directory = variable_get('file_directory_temp', NULL); if (is_null($temporary_directory)) { $directories = array(); Index: modules/color/color.module =================================================================== RCS file: /cvs/drupal/drupal/modules/color/color.module,v retrieving revision 1.45 diff -u -9 -p -r1.45 color.module --- modules/color/color.module 15 Sep 2008 21:06:07 -0000 1.45 +++ modules/color/color.module 18 Sep 2008 22:07:30 -0000 @@ -491,19 +491,19 @@ function _color_render_images($theme, &$ imagecopy($slice, $target, 0, 0, $x, $y, $width, $height); } // Save image. imagepng($slice, $image); imagedestroy($slice); $paths['files'][] = $image; // Set standard file permissions for webserver-generated files - @chmod(realpath($image), 0664); + @chmod(file_realpath($image), 0664); // Build before/after map of image paths. $paths['map'][$file] = $base; } // Clean up target buffer. imagedestroy($target); } Index: modules/simpletest/tests/file.dummystreamwrapper.inc =================================================================== RCS file: modules/simpletest/tests/file.dummystreamwrapper.inc diff -N modules/simpletest/tests/file.dummystreamwrapper.inc --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ modules/simpletest/tests/file.dummystreamwrapper.inc 18 Sep 2008 22:07:31 -0000 @@ -0,0 +1,275 @@ +fileHandle = fopen($nestedPath, $mode); + } else { + $this->fileHandle = @fopen($nestedPath, $mode); + } + return (bool) $this->fileHandle; + } + + /** + * Support for fread(), file_get_contents() etc. + * + * @param $count + * Maximum number of bytes to be read + * @return + * The string that was read, or FALSE in case of an error + */ + public function stream_read($count) { + return fread($this->fileHandle, $count); + } + + /** + * Support for fwrite(), file_put_contents() etc. + * + * @param $data + * The string to be written + * @return + * The number of bytes written + */ + public function stream_write($data) { + return fwrite($this->fileHandle, $data); + } + + /** + * Support for feof(). + * + * @return + * TRUE if end-of-file has been reached + */ + public function stream_eof() { + return feof($this->fileHandle); + } + + /** + * Support for fseek(). + * + * @param $offset + * The byte offset to got to + * @param $whence + * SEEK_SET, SEEK_CUR, or SEEK_END + * @return + * TRUE on success + */ + public function stream_seek($offset, $whence) { + return fseek($this->fileHandle, $offset, $whence); + } + + /** + * Support for fflush(). + * + * @return + * TRUE if data was successfully stored (or there was no data to store) + */ + public function stream_flush() { + return fflush($this->fileHandle); + } + + /** + * Support for ftell(). + * + * @return + * The current offset in bytes from the beginning of file + */ + public function stream_tell() { + return ftell($this->fileHandle); + } + + /** + * Support for fstat(). + * + * @return + * An array with file status, or false in case of an error - see fstat() + * for a description of this array + */ + public function stream_stat() { + return fstat($this->fileHandle); + } + + /** + * Support for fclose(). + */ + public function stream_close() { + return fclose($this->fileHandle); + } + + /** + * Support for unlink(). + * + * @param $path + * A string containing the path to the file to delete + * @return + * TRUE if file was successfully deleted + */ + public function unlink($path) { + return unlink(self::getNestedPath($path)); + } + + /** + * Support for rename(). + * + * @param $fromPath + * The path to the file to rename + * @param $toPath + * The new path to the file + * + * @return + * TRUE, if file was successfully renamed + */ + public function rename($fromPath, $toPath) { + return rename(self::getNestedPath($fromPath), self::getNestedPath($toPath)); + } + + /** + * Support for mkdir(). + * + * @param $path + * A string containing the path to the directory to create + * @param $mode + * Permission flags - see mkdir() + * @param $options + * A bit mask of STREAM_REPORT_ERRORS and STREAM_MKDIR_RECURSIVE + * @return + * TRUE if directory was successfully created + */ + public function mkdir($path, $mode, $options) { + $nestedPath = self::getNestedPath($path); + $recursive = (bool) $options & STREAM_MKDIR_RECURSIVE; + if ($options & STREAM_REPORT_ERRORS) { + return mkdir($nestedPath, $mode, $recursive); + } else { + return @mkdir($nestedPath, $mode, $recursive); + } + } + + /** + * Support for rmdir(). + * + * @param $path + * A string containing the path to the directory to delete + * @param $options + * A bit mask of STREAM_REPORT_ERRORS + * @return bool true if directory was successfully removed + */ + public function rmdir($path, $options) { + $nestedPath = self::getNestedPath($path); + if ($options & STREAM_REPORT_ERRORS) { + return rmdir($nestedPath); + } else { + return @rmdir($nestedPath); + } + } + + /** + * Support for stat(). + * + * @param $path + * A string containing the path to get information about + * @param $flags + * A bit mask of STREAM_URL_STAT_LINK and STREAM_URL_STAT_QUIET + * @return + * An array with file status, or FALSE in case of an error - see fstat() + * for a description of this array + */ + public function url_stat($path, $flags) { + $nestedPath = self::getNestedPath($path); + return ($flags & STREAM_URL_STAT_QUIET) + ? (file_exists($nestedPath) ? stat($nestedPath) : false) + : stat($nestedPath); + } + + /** + * Support for opendir(). + * + * @param $path + * A string containing the path to the directory to open + * @param $options + * Unknown (parameter is not documented in PHP Manual) + * @return + * TRUE on success + */ + public function dir_opendir($path, $options) { + $this->dirHandle = opendir(self::getNestedPath($path)); + return (bool) $this->dirHandle; + } + + /** + * Support for readdir(). + * + * @return + * The next filename, or FALSE if there are no more files in the directory + */ + public function dir_readdir() { + return readdir($this->dirHandle); + } + + /** + * Support for rewinddir(). + * + * @return + * TRUE on success + */ + public function dir_rewinddir() { + return rewinddir($this->dirHandle); + } + + /** + * Support for closedir(). + * + * @return + * TRUE on success + */ + public function dir_closedir() { + return closedir($this->dirHandle); + } + + /** + * Strips the stream wrapper prefix from the specified path. + * + * @param $path + * A string containing a path with a stream wrapper prefix + * @return + * The without a stream wrapper prefix + */ + private static function getNestedPath($path) { + return preg_replace('@^([a-z0-9.+-]{2,})://@i', '', $path); + } +} + Index: modules/simpletest/tests/file.test =================================================================== RCS file: /cvs/drupal/drupal/modules/simpletest/tests/file.test,v retrieving revision 1.4 diff -u -9 -p -r1.4 file.test --- modules/simpletest/tests/file.test 17 Sep 2008 07:11:58 -0000 1.4 +++ modules/simpletest/tests/file.test 18 Sep 2008 22:07:31 -0000 @@ -103,29 +103,29 @@ class FileValidateTest extends DrupalWeb $errors = file_validate_image_resolution($this->image, 0, '1x200'); $this->assertEqual(count($errors), 1, t("Got an error for an image that wasn't tall enough"), 'File'); $errors = file_validate_image_resolution($this->image, 0, '200x200'); $this->assertEqual(count($errors), 1, t("Small images report an error."), 'File'); // Maximum size if (image_get_toolkit()) { // Copy the image so that the original doesn't get resized. $temp_dir = file_directory_temp(); - copy(realpath('misc/druplicon.png'), realpath($temp_dir) .'/druplicon.png'); + copy(file_realpath('misc/druplicon.png'), file_realpath($temp_dir) .'/druplicon.png'); $this->image->filepath = $temp_dir .'/druplicon.png'; $errors = file_validate_image_resolution($this->image, '10x5'); $this->assertEqual(count($errors), 0, t("No errors should be reported when an oversized image can be scaled down."), 'File'); $info = image_get_info($this->image->filepath); $this->assertTrue($info['width'] <= 10, t("Image scaled to correct width."), 'File'); $this->assertTrue($info['height'] <= 5, t("Image scaled to correct height."), 'File'); - unlink(realpath($temp_dir .'/druplicon.png')); + unlink(file_realpath($temp_dir .'/druplicon.png')); } else { // TODO: should check that the error is returned if no toolkit is available. $errors = file_validate_image_resolution($this->image, '5x10'); $this->assertEqual(count($errors), 1, t("Oversize images that can't be scaled get an error."), 'File'); } // Clear out any resizing messages. drupal_get_messages(); @@ -211,26 +211,26 @@ class FileLoadSaveTest extends DrupalWeb } function testFileSaveData() { $contents = $this->randomName(8); // No filename $filepath = file_save_data($contents); $this->assertTrue($filepath, t("Unnamed file saved correctly")); $this->assertEqual(file_directory_path(), dirname($filepath), t("File was placed in Drupal's files directory")); - $this->assertEqual($contents, file_get_contents(realpath($filepath)), t("Contents of the file are correct.")); + $this->assertEqual($contents, file_get_contents(file_realpath($filepath)), t("Contents of the file are correct.")); // Provide a filename $filepath = file_save_data($contents, 'asdf.txt', FILE_EXISTS_REPLACE); $this->assertTrue($filepath, t("Unnamed file saved correctly")); $this->assertEqual(file_directory_path(), dirname($filepath), t("File was placed in Drupal's files directory.")); $this->assertEqual('asdf.txt', basename($filepath), t("File was named correctly.")); - $this->assertEqual($contents, file_get_contents(realpath($filepath)), t("Contents of the file are correct.")); + $this->assertEqual($contents, file_get_contents(file_realpath($filepath)), t("Contents of the file are correct.")); } } /** * Directory related tests. */ class FileDirectoryTest extends DrupalWebTestCase { /** * Implementation of getInfo(). @@ -419,19 +419,19 @@ class FileCopyDeleteMoveTest extends Dru // A directory to operate on. $this->dirname = file_directory_path() . '/' . $this->randomName(); mkdir($this->dirname); // Create a file for testing $f = new stdClass(); $f->filepath = file_directory_path() . '/' . $this->randomName(); $f->filename = basename($f->filepath); - touch($f->filepath); + file_put_contents($f->filepath, 'x'); $f->filemime = 'text/plain'; $f->uid = 1; $f->timestamp = REQUEST_TIME; $f->filesize = 0; drupal_write_record('files', $f); $this->file = $f; } function testFileDelete() { @@ -460,19 +460,19 @@ class FileCopyDeleteMoveTest extends Dru $new_filepath = file_move($this->file->filepath, $desired_filepath, FILE_EXISTS_ERROR); $this->assertTrue($new_filepath, t("Move was successful.")); $this->assertEqual($new_filepath, $desired_filepath, t("Returned expected filepath.")); $this->assertTrue(file_exists($new_filepath), t("File exists at the new location.")); $this->assertFalse(file_exists($this->file->filepath), t("No file remains at the old location.")); // Moving with rename. $desired_filepath = file_directory_path() . '/' . $this->randomName(); $this->assertTrue(file_exists($new_filepath), t("File exists before moving.")); - $this->assertTrue(touch($desired_filepath), t('Created a file so a rename will have to happen.')); + $this->assertTrue(file_put_contents($desired_filepath, 'x'), t('Created a file so a rename will have to happen.')); $newer_filepath = file_move($new_filepath, $desired_filepath, FILE_EXISTS_RENAME); $this->assertTrue($newer_filepath, t("Move was successful.")); $this->assertNotEqual($newer_filepath, $desired_filepath, t("Returned expected filepath.")); $this->assertTrue(file_exists($newer_filepath), t("File exists at the new location.")); $this->assertFalse(file_exists($new_filepath), t("No file remains at the old location.")); // TODO: test moving to a directory (rather than full directory/file path) } @@ -506,19 +506,19 @@ class FileCopyDeleteMoveTest extends Dru $desired_filepath = file_directory_path() . '/' . $this->randomName(); $new_filepath = file_copy($this->file->filepath, $desired_filepath, FILE_EXISTS_ERROR); $this->assertTrue($new_filepath, t("Copy was successful.")); $this->assertEqual($new_filepath, $desired_filepath, t("Returned expected filepath.")); $this->assertTrue(file_exists($this->file->filepath), t("Original file remains.")); $this->assertTrue(file_exists($new_filepath), t("New file exists.")); // Copying with rename. $desired_filepath = file_directory_path() . '/' . $this->randomName(); - $this->assertTrue(touch($desired_filepath), t('Created a file so a rename will have to happen.')); + $this->assertTrue(file_put_contents($desired_filepath, 'x'), t('Created a file so a rename will have to happen.')); $newer_filepath = file_copy($new_filepath, $desired_filepath, FILE_EXISTS_RENAME); $this->assertTrue($newer_filepath, t("Copy was successful.")); $this->assertNotEqual($newer_filepath, $desired_filepath, t("Returned expected filepath.")); $this->assertTrue(file_exists($this->file->filepath), t("Original file remains.")); $this->assertTrue(file_exists($new_filepath), t("New file exists.")); // TODO: test copying to a directory (rather than full directory/file path) } Index: modules/system/image.gd.inc =================================================================== RCS file: /cvs/drupal/drupal/modules/system/image.gd.inc,v retrieving revision 1.2 diff -u -9 -p -r1.2 image.gd.inc --- modules/system/image.gd.inc 16 Jul 2008 21:59:28 -0000 1.2 +++ modules/system/image.gd.inc 18 Sep 2008 22:07:31 -0000 @@ -190,32 +190,41 @@ function image_gd_open($file, $extension return $open_func($file); } /** * GD helper to write an image resource to a destination file. * * @param $res * An image resource created with image_gd_open(). * @param $destination - * A string file path where the iamge should be saved. + * A string file path where the image should be saved. * @param $extension * A string containing one of the following extensions: gif, jpg, jpeg, png. * @return * Boolean indicating success. */ function image_gd_close($res, $destination, $extension) { $extension = str_replace('jpg', 'jpeg', $extension); $close_func = 'image' . $extension; if (!function_exists($close_func)) { return FALSE; } + + // These functions do not support stream wrappers + $output_file = file_is_wrapper($destination) ? tempnam(file_realpath(file_directory_temp()), 'image') : $destination; if ($extension == 'jpeg') { - return $close_func($res, $destination, variable_get('image_jpeg_quality', 75)); + $ok = $close_func($res, $output_file, variable_get('image_jpeg_quality', 75)); } else { - return $close_func($res, $destination); + $ok = $close_func($res, $output_file); + } + + if ($ok && $destination != $output_file) { + $ok = copy($output_file, $destination); + @unlink($output_file); } + return $ok; } /** * @} End of "ingroup image". */ Index: modules/system/system.admin.inc =================================================================== RCS file: /cvs/drupal/drupal/modules/system/system.admin.inc,v retrieving revision 1.89 diff -u -9 -p -r1.89 system.admin.inc --- modules/system/system.admin.inc 17 Sep 2008 07:11:58 -0000 1.89 +++ modules/system/system.admin.inc 18 Sep 2008 22:07:31 -0000 @@ -1457,19 +1457,19 @@ function system_file_system_settings() { '#description' => t('A file system path where the files will be stored. This directory must exist and be writable by Drupal. If the download method is set to public, this directory must be relative to the Drupal installation directory and be accessible over the web. If the download method is set to private, this directory should not be accessible over the web. Changing this location will modify all download paths and may cause unexpected problems on an existing site.'), '#after_build' => array('system_check_directory'), ); $form['file_directory_temp'] = array( '#type' => 'textfield', '#title' => t('Temporary directory'), '#default_value' => file_directory_temp(), '#maxlength' => 255, - '#description' => t('A file system path where uploaded files will be stored during previews.'), + '#description' => t('A file system path where temporary files may be stored.'), '#after_build' => array('system_check_directory'), ); $form['file_downloads'] = array( '#type' => 'radios', '#title' => t('Download method'), '#default_value' => variable_get('file_downloads', FILE_DOWNLOADS_PUBLIC), '#options' => array(FILE_DOWNLOADS_PUBLIC => t('Public - files are available using HTTP directly.'), FILE_DOWNLOADS_PRIVATE => t('Private - files are transferred by Drupal.')), '#description' => t('Choose the Public download method unless you wish to enforce fine-grained access controls over file downloads. Changing the download method will modify all download paths and may cause unexpected problems on an existing site.') Index: modules/upload/upload.test =================================================================== RCS file: /cvs/drupal/drupal/modules/upload/upload.test,v retrieving revision 1.4 diff -u -9 -p -r1.4 upload.test --- modules/upload/upload.test 15 Sep 2008 09:28:50 -0000 1.4 +++ modules/upload/upload.test 18 Sep 2008 22:07:31 -0000 @@ -174,19 +174,19 @@ class UploadTestCase extends DrupalWebTe } } /** * Check that uploaded file is accessible and verify the contents against the original. * * @param string $filename Name of file to verifiy. */ function checkUploadedFile($filename) { - $file = realpath(file_directory_path() . '/' . $filename); + $file = file_realpath(file_directory_path() . '/' . $filename); $this->drupalGet(file_directory_path() . '/' . $filename); $this->assertResponse(array(200), 'Uploaded ' . $filename . ' is accessible.'); $this->assertEqual(file_get_contents($file), $this->drupalGetContent(), 'Uploaded contents of ' . $filename . ' verified.'); } /** * Get the role id of the 'simpletest' role associated with a SimpleTest test user. * * @param object $user User object.