search

nextcloud / cms_pico

🗃 Integrate Pico CMS and let your users manage their own websites
https://apps.nextcloud.com/apps/cms_pico
GNU Affero General Public License v3.0
137 stars 43 forks source link

Refactor StorageFolder::newFile() and newFolder() #167

Closed PhrozenByte closed 3 years ago

PhrozenByte commented 3 years ago

Nextcloud's file operations API apparently is unable to proberly deal with relative paths (even though the docs tell us otherwise). It …

  1. performs file permission checks on the base directory rather than the respective parent directory (:confused:), causing #141, and
  2. blocks relative paths like .. (likely as a security measure - by using the most unsophisticated approach :unamused:).

Also see nextcloud/server#26396.

Fixes #141 #165

@szaimen @matrois: Since I still don't know what exactly you guys are doing to cause this issue, I couldn't test it. Please give it a try.

szaimen commented 3 years ago

Unfortunately I cannot test this since I get

error: patch failed: lib/Files/LocalFolder.php:153
error: lib/Files/LocalFolder.php: patch does not apply

when I try to apply the patch...

szaimen commented 3 years ago

@PhrozenByte if you want to test this yourself you should be able to reproduce this issue by following:

  1. Make your Nextcloud root folder read only by mounting a local external storage to Nextcloud, making it read only and naming it /.
  2. Create a second local external storage, name it differently and make it writeable.
  3. try to create a new website in the second local external storage with the cms_pico app
PhrozenByte commented 3 years ago

No need to apply the patch manually, simply clone the branch (or download the source ZIP from https://github.com/nextcloud/cms_pico/archive/refs/heads/bugfix/141.zip) and run composer install.

szaimen commented 3 years ago

Thanks! I've done that in a VM and I can report that it fixes my issues with read only root folder. Thank you! :)

PhrozenByte commented 3 years ago

Let's give @matrois a few more days to test this, too.