Thumbnails not creted

  • Posts: 38
  • Thank you received: 1
7 years 3 months ago #259217

Hi,

I have special server configuration, images folder is shared between multiple sites, using symlink, so the directory structure looks like this
/var/www/site1/
/var/www/shared/images
and /var/www/site1/images is symbolic link pointing to /var/www/shared/images

In this configuration thumbnails are not created (even all paths are writable). Reason is in adimnistrator/components/com_hikashop/helpers/image.php on line 337

		$clean_filename = $fullFilename;
		try{
			$clean_filename = JPath::clean(realpath($fullFilename));
			if((JPATH_ROOT != '') && strpos($clean_filename, JPath::clean(JPATH_ROOT)) !== 0) {
				if(!defined('MULTISITES_MASTER_ROOT_PATH') || MULTISITES_MASTER_ROOT_PATH == '' || strpos($clean_filename, JPath::clean(MULTISITES_MASTER_ROOT_PATH)) !== 0)
					return $ret;
			}
		}catch(Exception $e) {
		}
as realpath translates /var/www/site1/images/.... to /var/www/shared/images/..... so the check will not pass.

Is it necessary to call realpath at this point?

I solved my issue by defining MULTISITES_MASTER_ROOT_PATH (even I do not use Multisites), but it took me few hours to fnd out reason, if realpath could not be removed, maybe some configuration option would be great.

Pavel

Please Log in or Create an account to join the conversation.

  • Posts: 81597
  • Thank you received: 13081
  • MODERATOR
7 years 3 months ago #259238

Hi,

Calling realpath here is necessary as a security check in order to avoid having people upload files outside the upload directory.
defining MULTISITES_MASTER_ROOT_PATH is indeed a good way to keep the security check in place and allow to specify different paths like you need.

Please Log in or Create an account to join the conversation.

  • Posts: 38
  • Thank you received: 1
7 years 3 months ago #259296

Hi,

I understand, that realpath is used to remove /../ from the path, so user will not try to upload something somewhere, where he is not allowed. However side effect is that symbolic links are evaluated. Which leads to this problem.

Setting MULTISITES_MASTER_ROOT_PATH helped, but just in frontend. In the administration problem still remains. For temporary I removed realpath from Image helper file (it is on two places there) and from File class (on one place), and administration starts to work.

MULTISITES_MASTER_ROOT_PATH is not used on these other places, so the check should be extended also here. If I will make changes, do you accept code submissions?

Pavel

Please Log in or Create an account to join the conversation.

  • Posts: 26017
  • Thank you received: 4004
  • MODERATOR
7 years 3 months ago #259297

Hi,

If your code submission is a patch which will serve the community and/or fix an issue (without creating security problem), sure !

Regards,


Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.

Also helping the HikaShop support team when having some time or couldn't sleep.
By the way, do not send me private message, use the "contact us" form instead.

Please Log in or Create an account to join the conversation.

  • Posts: 38
  • Thank you received: 1
7 years 3 months ago #259321

Ok, finally I found out the problem. MULTISITES_MASTER_ROOT_PATH solves the issue, however, I used defines.php file to define this constant, and I didn't realize that administartion has its standalone defines.php.

So the problem is solved.

Maybe some documentation note on this situation would be great.

Thanks for your help

Pavel

Please Log in or Create an account to join the conversation.

Time to create page: 0.052 seconds
Powered by Kunena Forum