artgris / FileManagerBundle

FileManager is a simple Multilingual File Manager Bundle for Symfony
MIT License
171 stars 89 forks source link

Cannot browse symlinks outside configured directory #80

Closed kosmodisk closed 3 years ago

kosmodisk commented 3 years ago

I was trying to symlink upload directory but FileManager does not allow it.

# \Artgris\Bundle\FileManagerBundle\Helpers\FileManager::checkSecurity

        $currentPath = $this->getCurrentPath();

        // check Path security
        if (false === $currentPath || 0 !== mb_strpos($currentPath, $this->getBasePath())) {
            throw new HttpException(Response::HTTP_UNAUTHORIZED, 'You are not allowed to access this folder.');
        }

getCurrentPath resolves symlinks and yields outside configured directory. But I think this is unnecessary restriction.

artgris commented 3 years ago

Hi, I use symlink very often, and I don't have any problems. Can you show me your config and/or do

dump($currentPath);
dd($this->getBasePath());

after $currentPath = $this->getCurrentPath(); plz