Skip to main content

Thumbnails not creted

More
9 years 8 months ago #259217 by n3t
Thumbnails not creted was created by n3t
Hi,

I have special server configuration, images folder is shared between multiple sites, using symlink, so the directory structure looks like this
/var/www/site1/
/var/www/shared/images
and /var/www/site1/images is symbolic link pointing to /var/www/shared/images

In this configuration thumbnails are not created (even all paths are writable). Reason is in adimnistrator/components/com_hikashop/helpers/image.php on line 337
Code:
$clean_filename = $fullFilename; try{ $clean_filename = JPath::clean(realpath($fullFilename)); if((JPATH_ROOT != '') && strpos($clean_filename, JPath::clean(JPATH_ROOT)) !== 0) { if(!defined('MULTISITES_MASTER_ROOT_PATH') || MULTISITES_MASTER_ROOT_PATH == '' || strpos($clean_filename, JPath::clean(MULTISITES_MASTER_ROOT_PATH)) !== 0) return $ret; } }catch(Exception $e) { }
as realpath translates /var/www/site1/images/.... to /var/www/shared/images/..... so the check will not pass.

Is it necessary to call realpath at this point?

I solved my issue by defining MULTISITES_MASTER_ROOT_PATH (even I do not use Multisites), but it took me few hours to fnd out reason, if realpath could not be removed, maybe some configuration option would be great.

Pavel

Please Log in or Create an account to join the conversation.

More
9 years 8 months ago #259238 by nicolas
Replied by nicolas on topic Thumbnails not creted
Hi,

Calling realpath here is necessary as a security check in order to avoid having people upload files outside the upload directory.
defining MULTISITES_MASTER_ROOT_PATH is indeed a good way to keep the security check in place and allow to specify different paths like you need.

Please Log in or Create an account to join the conversation.

More
9 years 8 months ago #259296 by n3t
Replied by n3t on topic Thumbnails not creted
Hi,

I understand, that realpath is used to remove /../ from the path, so user will not try to upload something somewhere, where he is not allowed. However side effect is that symbolic links are evaluated. Which leads to this problem.

Setting MULTISITES_MASTER_ROOT_PATH helped, but just in frontend. In the administration problem still remains. For temporary I removed realpath from Image helper file (it is on two places there) and from File class (on one place), and administration starts to work.

MULTISITES_MASTER_ROOT_PATH is not used on these other places, so the check should be extended also here. If I will make changes, do you accept code submissions?

Pavel

Please Log in or Create an account to join the conversation.

More
9 years 8 months ago #259297 by Jerome
Replied by Jerome on topic Thumbnails not creted
Hi,

If your code submission is a patch which will serve the community and/or fix an issue (without creating security problem), sure !

Regards,

Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.

Please Log in or Create an account to join the conversation.

More
9 years 8 months ago #259321 by n3t
Replied by n3t on topic Thumbnails not creted
Ok, finally I found out the problem. MULTISITES_MASTER_ROOT_PATH solves the issue, however, I used defines.php file to define this constant, and I didn't realize that administartion has its standalone defines.php.

So the problem is solved.

Maybe some documentation note on this situation would be great.

Thanks for your help

Pavel

Please Log in or Create an account to join the conversation.

Time to create page: 0.178 seconds
Powered by Kunena Forum