search

JamesHeinrich / phpThumb

phpThumb() - The PHP thumbnail generator
Other
315 stars 98 forks source link

phpthumb is falling when /home directory is protected #116

Open sashabeep opened 6 years ago

sashabeep commented 6 years ago

My hoster offers site isolation functionality when no one site knows about root level directory and cannot access to it. But after this feature enabled this function https://github.com/JamesHeinrich/phpThumb/blob/4bb058e3b141f969fdb4017750adb0c39234388f/phpthumb.class.php#L1165

throws warning

Error : is_link(): IHC isolation in effect. File(/home) is not within the allowed path(s)
-----
if (is_link($thispart)) {

Can you point me to solution? Maybe some settings in php.ini will fix this problem? As i can understand, this function verifies that some of path parts are not symlink. Can i rewrite it somehow? I'm not use symlinks at all on shared hostings. Commenting the whole cycle makes phpthumb unuseable

JamesHeinrich commented 6 years ago

I'm not sure. I don't have any way to replicate your environment so I'll leave it to you to figure out a proper workaround. Or perhaps someone else can chime in and offer their suggestions.

A very poor temporary fix would be to simply put return $path; before the problem line and effectively bypass the whole checking mechanism, but that should be avoided except for local testing.

sashabeep commented 6 years ago

module realpath_turbo was used for this https://github.com/Whissi/realpath_turbo