Problem/Motivation

The update_manager_file_get() function checks the argument url against a small hard-coded list of remote file schemes, and assumes that all other URIs may be resolved to paths on the local filesystem. This assumption is wrong and unnecessary. The code may be made simpler and more robust by simply passing the URI to \Drupal::service('file_system')->realpath() A return value of FALSE indicates that the scheme does not support translation to a local filesystem path.

Proposed resolution

The code should be modified as described above.

Remaining tasks

Review patch
Commit

User interface changes

None.

API changes

None.

CommentFileSizeAuthor
#20 1283536-20.patch1.65 KBsmustgrave
#20 interdiff-18-20.txt632 bytessmustgrave
#18 1283536-18.patch1.62 KBsmustgrave
#1 update_manager_file_get-fix-drupal_realpath-usage-1283536-1.patch1.9 KBpillarsdotnet

Comments

pillarsdotnet’s picture

pillarsdotnet commented
Status: Active » Needs review
StatusFileSize
new update_manager_file_get-fix-drupal_realpath-usage-1283536-1.patch1.9 KB

Patch.

Leeteq’s picture

Leeteq commented

This one needs to be tagged as "backport to D7", I guess.

pillarsdotnet’s picture

pillarsdotnet commented
Issue tags: +Needs backport to D7

Sure; why not?

kscheirer’s picture

kscheirer
Primary language English
Location Vallejo
commented
Issue tags: -Needs backport to D7

#1: update_manager_file_get-fix-drupal_realpath-usage-1283536-1.patch queued for re-testing.

Status: Needs review » Needs work

The last submitted patch, update_manager_file_get-fix-drupal_realpath-usage-1283536-1.patch, failed testing.

Anonymous’s picture

(not verified) commented
Issue summary: View changes

Updated status.

Version: 8.0.x-dev » 8.1.x-dev

Drupal 8.0.6 was released on April 6 and is the final bugfix release for the Drupal 8.0.x series. Drupal 8.0.x will not receive any further development aside from security fixes. Drupal 8.1.0-rc1 is now available and sites should prepare to update to 8.1.0.

Bug reports should be targeted against the 8.1.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.2.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.1.x-dev » 8.2.x-dev

Drupal 8.1.9 was released on September 7 and is the final bugfix release for the Drupal 8.1.x series. Drupal 8.1.x will not receive any further development aside from security fixes. Drupal 8.2.0-rc1 is now available and sites should prepare to upgrade to 8.2.0.

Bug reports should be targeted against the 8.2.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.2.x-dev » 8.3.x-dev

Drupal 8.2.6 was released on February 1, 2017 and is the final full bugfix release for the Drupal 8.2.x series. Drupal 8.2.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.3.0 on April 5, 2017. (Drupal 8.3.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.3.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.6 was released on August 2, 2017 and is the final full bugfix release for the Drupal 8.3.x series. Drupal 8.3.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.4.0 on October 4, 2017. (Drupal 8.4.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.4.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.4 was released on January 3, 2018 and is the final full bugfix release for the Drupal 8.4.x series. Drupal 8.4.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.5.0 on March 7, 2018. (Drupal 8.5.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.5.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.6 was released on August 1, 2018 and is the final bugfix release for the Drupal 8.5.x series. Drupal 8.5.x will not receive any further development aside from security fixes. Sites should prepare to update to 8.6.0 on September 5, 2018. (Drupal 8.6.0-rc1 is available for testing.)

Bug reports should be targeted against the 8.6.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.8.x-dev

Drupal 8.6.x will not receive any further development aside from security fixes. Bug reports should be targeted against the 8.8.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.9.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.2.x-dev

Drupal 8 is end-of-life as of November 17, 2021. There will not be further changes made to Drupal 8. Bugfixes are now made to the 9.3.x and higher branches only. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.15 was released on June 1st, 2022 and is the final full bugfix release for the Drupal 9.3.x series. Drupal 9.3.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.4.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

quietone’s picture

quietone commented
Issue summary: View changes
Issue tags: +Bug Smash Initiative, +Needs reroll

Discuss at Bug smash group triage meeting. This code is still in drupal 9.5.x, so tagging for a reroll.

smustgrave’s picture

smustgrave commented
Status: Needs work » Needs review
Issue tags: -Needs reroll
StatusFileSize
new 1283536-18.patch1.62 KB
amber himes matz’s picture

amber himes matz
she/her
Primary language English
Location Portland, OR USA
commented
Issue tags: +Needs issue summary update

This needs an issue summary update a new proposed resolution because the use of drupal_realpath() was originally written to ease porting of 6.x code to use 7.x stream wrappers. (See #1201024: drupal_realpath() should describe when it should be used and #1083982: Fix support for remote streamwrappers.)

smustgrave’s picture

smustgrave commented
Issue summary: View changes
Issue tags: -Needs issue summary update
StatusFileSize
new interdiff-18-20.txt632 bytes
new 1283536-20.patch1.65 KB

Updated IS hopefully makes sense.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.9 was released on December 7, 2022 and is the final full bugfix release for the Drupal 9.4.x series. Drupal 9.4.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.5.x-dev branch from now on, and new development or disruptive changes should be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

smustgrave’s picture

smustgrave commented
Status: Needs review » Needs work
Issue tags: +Needs Review Queue Initiative, +Needs tests

Self review.

This will need a test case.

Version: 9.5.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

dww’s picture

dww
we/he/they
commented
Status: Needs work » Closed (outdated)
Related issues: +#3491731: [META] Remove the ability to update modules and themes via authorize.php

Now that #3491731: [META] Remove the ability to update modules and themes via authorize.php and child issues are done, this code is all deprecated and will be removed in D12.