psolom / RichFilemanager

An open-source file manager. Up-to-date for PHP, Java, ASHX, ASP, NodeJs & Python 3 Flask. Contributions are welcome!
http://fm.devale.pro
907 stars 252 forks source link

IIS bug. "Directory path '/' is invalid" #299

Closed Guanche closed 6 years ago

Guanche commented 6 years ago

In raising this issue, I confirm the following (please check boxes):

I use the following server-side connector (check one):

My familiarity with the project is as follows (check one):


Hi, an error happens when using the plugin with IIS. After a correct instalation this message appears everytime: "Directory path '/' is invalid".

The problem is into ItemModel.php, at connectors\php\vendor\servocoder\richfilemanager-php\src\Repository\Local, at this lines:

$realPathItem = realpath($this->pathAbsolute);
$realPathRoot = realpath($this->storage->getRoot());
array_unshift($allowedPaths, $realPathRoot);

// clean up paths for more accurate comparison
$allowedPaths = array_map([$this->storage, 'cleanPath'], $allowedPaths);
$match = starts_with($realPathItem, $allowedPaths);

if (!$match) {
        Log::info('Item path validation FAILED');            
        Log::info('Absolute path "' . $this->pathAbsolute . '"');            
        Log::info('Real path: "' . $realPathItem . '"');            
        Log::info('Tested paths: "' . json_encode($allowedPaths) . '"');
}
return $match;

What I did to solve it was replacing this lines:

/*
$realPathItem = realpath($this->pathAbsolute);
$realPathRoot = realpath($this->storage->getRoot());
*/

$realPathItem = $this->pathAbsolute;        
$realPathRoot = $this->storage->getRoot();

realpath function returns the path in windows format, using \ as separator. While method cleanPath turns \ into /. And then they don't match.

Now it seems that works fine. I've not had any problems till now.

Greetings from the Canary Islands.

psolom commented 6 years ago

I'm glad you solved your issue, but realpath is important security check. Using it we can make sure that there are no symlinks linked to restricted locations outside userfiles folder. So I strongly don't recommend you to avoid it.

What if you rewrite it in the following way:

$match = starts_with($this->storage->cleanPath($realPathItem), $allowedPaths);

This is appropriate solution that I can include in the next release.

I believe this should work for you. Let me know if so.

Guanche commented 6 years ago

Thanks. As you say it works ok.

psolom commented 6 years ago

Fixed. Will be included in the next release.