← All changes | app/Http/Controllers/FileUploadController.php +10 -0 1.6.1 → 1.6.6 View file →

		@@ -6,8 +6,9 @@
6	6	use FluentCart\Api\StorageDrivers;
7	7	use FluentCart\App\Hooks\Handlers\GlobalStorageHandler;
8	8	use FluentCart\App\Http\Requests\UserRequest;
9	9	use FluentCart\App\Services\FileSystem\FileManager;
	10	+use FluentCart\App\Services\FileSystem\StoragePath;
10	11	use FluentCart\Framework\Http\Request\File;
11	12	use FluentCart\Framework\Http\Request\Request;
12	13	use FluentCart\Framework\Support\Arr;
13	14	use FluentCart\Framework\Support\Str;
		@@ -140,8 +141,17 @@
140	141
141	142	$filePath = sanitize_text_field($request->get('file_path'));
142	143	$driver = sanitize_text_field($request->get('driver'));
143	144	$bucket = sanitize_text_field($request->get('bucket'));
	145	+
	146	+ // `..` survives sanitize_text_field(). The local driver contains the
	147	+ // path itself, but no driver has a use for a relative segment, so it is
	148	+ // refused here for every driver.
	149	+ if (!StoragePath::isSafe($filePath)) {
	150	+ return $this->sendError([
	151	+ 'message' => __('Invalid file path', 'fluent-cart')
	152	+ ], 422);
	153	+ }
144	154
145	155	$result = (new FileManager($driver))->deleteFile($filePath, $bucket);
146	156
147	157	if (is_wp_error($result)) {