Skip to content

Conversation

@michalbundyra
Copy link
Contributor

Method was called from getContent with the full file path (see lines 36 and 43) and inside the method isExpired baseDir was added another time (see line 57), so as the result we have: "baseDir/baseDir/fileName.ext"

public function getContent($file)
{
$file = $this->baseDir . $file;
if ($this->baseDir && !Latte\Helpers::startsWith($this->normalizePath($file), $this->baseDir)) {
throw new \RuntimeException("Template '$file' is not within the allowed path '$this->baseDir'.");
} elseif (!is_file($file)) {
throw new \RuntimeException("Missing template file '$file'.");
} elseif ($this->isExpired($file, time())) {

public function isExpired($file, $time)
{
return @filemtime($this->baseDir . $file) > $time; // @ - stat may fail

Fix for 2.4 branch, but it should be also fixed on master.

  • bug fix? yes/no
  • new feature? yes/no
  • BC break? yes/no
  • doc PR: nette/docs#???

Method was called from getContent with the full file path
and inside the method baseDir was added another time,
so as the result we have: "baseDir/baseDir/fileName.ext"
@dg
Copy link
Member

dg commented Nov 28, 2017

Thanks!

@dg dg merged commit 2010e6e into nette:v2.4 Nov 28, 2017
dg pushed a commit that referenced this pull request Nov 28, 2017
Method was called from getContent with the full file path
and inside the method baseDir was added another time,
so as the result we have: "baseDir/baseDir/fileName.ext"
@michalbundyra michalbundyra deleted the hotfix/is-expired branch November 28, 2017 22:46
dg pushed a commit that referenced this pull request Nov 28, 2017
Method was called from getContent with the full file path
and inside the method baseDir was added another time,
so as the result we have: "baseDir/baseDir/fileName.ext"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants