Currently file_check_location is always returning false when passed a file as the $source path. If a directory is passed in $soruce file_check_location works. I've tracked this down to realpath returning an empty string when passed a relative path which points to a file. This probably goes unnoticed if you are using the file.api's to construct relative paths to the druapl file directory since check_location failing just causes the durpal file directory to get added which is what you wanted in the first place.

Replacing this line

  $source = realpath(dirname($source));

with this

  $source = realpath(dirname($source));

fixes it on my windows box using PHP 4.3.8.

I don't have things set up to do patches on my windows boxes here at work yet. I'll submit a formal patch tonight.

CommentFileSizeAuthor
#3 checklocation.patch666 bytesccourtne
#2 file-inc-file_check_location.patch639 bytesAnonymous (not verified)

Comments

ccourtne’s picture

Dag nabit.

Replace

  $source = realpath($source);

with

  $source = realpath(dirname($source));

Craig

Anonymous’s picture

StatusFileSize
new639 bytes

The sooner there are patches, the better it is...

I tested this approach on my server and it works.

Steef

ccourtne’s picture

StatusFileSize
new666 bytes

Here is the patch.

dan90@drupal.org’s picture

This also fixed my file upload problems with some nonstandard paths under Linux/apache, php 4.3.4 drupal 4.5.2. maybe we should remove mention of windows 2000?

killes@www.drop.org’s picture

Still applies.

ec’s picture

Is this patch still to be use with actual Drupal 4.6.0 ? Thanks. eric

Wes Cowley’s picture

I hand applied the patch to my Linux based installation and it solved the problem I was having with filemanager/attachment. I assume it would fix the same problem I had with upload.module since the symptoms were identical.

Wes Cowley’s picture

Meant to add, that was a 4.6.0 Linux installaion that this patch cleared up.

larryjhs’s picture

Thanks, still, I'm a bit of a php newbie -- where do I put the patch -- into which bit of script? If it's not too obvious, tell me and I won't try! But if it's obvious, please give me the location

L

ec’s picture

This patch seem still to apply to 4.6 (I'm using it on my linux box too and it solve my problem with upload.module) it apply on "file.inc" that you will find in includes directory on top of your drupal root. Put the patch in the same directory as file.inc go in this directory too and apply the patch like this "patch -p0 < the_patch_to_apply" where patch is the command on *nix box. If you're not confortable you can either edit the file.inc by hand and make the change yourself, in the patch file, line beginning with "-" is the one to remove, line beginning with "+" is the one to add, other lines are the context so you're sure to find the right line. Hope this help. Regards.

ec’s picture

BTW, IMHO this patch should be committed ASAP as it's solve the problem with upload.module that can't handle private directory outside drupal root. Tested on my sites ans work (for now ;-) like a charm. Regards.

dries’s picture

Don't we use file_create_path for that (it appends the 'files'-bit)?

ec’s picture

On my linux box, I make an other test with the latest stock release of file.inc. I setup files directectory, with "private" check, outside drupal root and drupal complains The directory does not exist (I know this directory exists and is working because I'm using it !). It only works with the patch below. Sorry, I'm not confortable enought to answer your question Dries, but sure this patch is the only I found to have a real private directory working. Regards, eric.

PS : I don't why but got an error each time I want to upload a file here ??? so here is the text against the latest release of file.inc i.e 1.39.2.2


--- ./file.inc 2005-05-15 21:52:40.758531811 +0200
+++ ./file_mod_ec.inc 2005-05-15 22:03:41.869608738 +0200
@@ -169,7 +169,7 @@
* @return 0 for invalid path or the real path of the source.
*/
function file_check_location($source, $directory = 0) {
- $source = realpath($source);
+ $source = realpath(dirname($source));
$directory = realpath($directory);
if ($directory && strpos($source, $directory) !== 0) {
return 0;
>/code>

Rick Cogley’s picture

The patch fixed uploads for me as well on 4.6.0.

dries’s picture

This patch no longer applies against HEAD or DRUPAL-4-6. Could someone try reproducing this problemwith the latest version in either branch, and provide an updated patch. (I think the problem still needs fixing but I'm not sure and can't reproduce the problem.)

Uncas’s picture

Still applies for me on 4.6.
I don't know how to build patches, so I just solved the problem by replacing line 168 of file.inc as suggested originally.

ccourtne’s picture

Status: Needs review » Closed (fixed)

Latest CVS has this issue fixed.