Currently file_check_location is always returning false when passed a file as the $source path. If a directory is passed in $soruce file_check_location works. I've tracked this down to realpath returning an empty string when passed a relative path which points to a file. This probably goes unnoticed if you are using the file.api's to construct relative paths to the druapl file directory since check_location failing just causes the durpal file directory to get added which is what you wanted in the first place.
Replacing this line
$source = realpath(dirname($source));
with this
$source = realpath(dirname($source));
fixes it on my windows box using PHP 4.3.8.
I don't have things set up to do patches on my windows boxes here at work yet. I'll submit a formal patch tonight.
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | checklocation.patch | 666 bytes | ccourtne |
| #2 | file-inc-file_check_location.patch | 639 bytes | Anonymous (not verified) |
Comments
Comment #1
ccourtne commentedDag nabit.
Replace
with
Craig
Comment #2
(not verified) commentedThe sooner there are patches, the better it is...
I tested this approach on my server and it works.
Steef
Comment #3
ccourtne commentedHere is the patch.
Comment #4
dan90@drupal.org commentedThis also fixed my file upload problems with some nonstandard paths under Linux/apache, php 4.3.4 drupal 4.5.2. maybe we should remove mention of windows 2000?
Comment #5
killes@www.drop.org commentedStill applies.
Comment #6
ec commentedIs this patch still to be use with actual Drupal 4.6.0 ? Thanks. eric
Comment #7
Wes Cowley commentedI hand applied the patch to my Linux based installation and it solved the problem I was having with filemanager/attachment. I assume it would fix the same problem I had with upload.module since the symptoms were identical.
Comment #8
Wes Cowley commentedMeant to add, that was a 4.6.0 Linux installaion that this patch cleared up.
Comment #9
larryjhs commentedThanks, still, I'm a bit of a php newbie -- where do I put the patch -- into which bit of script? If it's not too obvious, tell me and I won't try! But if it's obvious, please give me the location
L
Comment #10
ec commentedThis patch seem still to apply to 4.6 (I'm using it on my linux box too and it solve my problem with upload.module) it apply on "file.inc" that you will find in includes directory on top of your drupal root. Put the patch in the same directory as file.inc go in this directory too and apply the patch like this "patch -p0 < the_patch_to_apply" where patch is the command on *nix box. If you're not confortable you can either edit the file.inc by hand and make the change yourself, in the patch file, line beginning with "-" is the one to remove, line beginning with "+" is the one to add, other lines are the context so you're sure to find the right line. Hope this help. Regards.
Comment #11
ec commentedBTW, IMHO this patch should be committed ASAP as it's solve the problem with upload.module that can't handle private directory outside drupal root. Tested on my sites ans work (for now ;-) like a charm. Regards.
Comment #12
dries commentedDon't we use
file_create_pathfor that (it appends the 'files'-bit)?Comment #13
ec commentedOn my linux box, I make an other test with the latest stock release of file.inc. I setup files directectory, with "private" check, outside drupal root and drupal complains
The directory does not exist(I know this directory exists and is working because I'm using it !). It only works with the patch below. Sorry, I'm not confortable enought to answer your question Dries, but sure this patch is the only I found to have a real private directory working. Regards, eric.PS : I don't why but got an error each time I want to upload a file here ??? so here is the text against the latest release of file.inc i.e 1.39.2.2
--- ./file.inc 2005-05-15 21:52:40.758531811 +0200
+++ ./file_mod_ec.inc 2005-05-15 22:03:41.869608738 +0200
@@ -169,7 +169,7 @@
* @return 0 for invalid path or the real path of the source.
*/
function file_check_location($source, $directory = 0) {
- $source = realpath($source);
+ $source = realpath(dirname($source));
$directory = realpath($directory);
if ($directory && strpos($source, $directory) !== 0) {
return 0;
>/code>
Comment #14
Rick Cogley commentedThe patch fixed uploads for me as well on 4.6.0.
Comment #15
dries commentedThis patch no longer applies against HEAD or DRUPAL-4-6. Could someone try reproducing this problemwith the latest version in either branch, and provide an updated patch. (I think the problem still needs fixing but I'm not sure and can't reproduce the problem.)
Comment #16
Uncas commentedStill applies for me on 4.6.
I don't know how to build patches, so I just solved the problem by replacing line 168 of file.inc as suggested originally.
Comment #17
ccourtne commentedLatest CVS has this issue fixed.