[BUGFIX] Avoid realpath resolving in PharStreamWrapperInterceptor 39/60739/2
authorOliver Hader <oliver@typo3.org>
Mon, 13 May 2019 08:39:33 +0000 (10:39 +0200)
committerAndreas Fernandez <a.fernandez@scripting-base.de>
Wed, 15 May 2019 07:10:15 +0000 (09:10 +0200)
Given that e.g. public/typo3conf/ext/my_extension is symlinked to
packages/my_extension, PharStreamWrapper denies invocation since
realpath is resolved.

For the specific PharStreamWrapperInterceptor it is okay to avoid
realpath resolving.

Resolves: #88340
Releases: master, 9.5, 8.7
Change-Id: I46b7100547dd0e40d1d4d76a71047ef977d8ce63
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60739
Tested-by: TYPO3com <noreply@typo3.com>
Tested-by: Mathias Brodala <mbrodala@pagemachine.de>
Tested-by: tomalo.stuttgart <loeffler@spooner-web.de>
Tested-by: Markus Klein <markus.klein@typo3.org>
Tested-by: Andreas Fernandez <a.fernandez@scripting-base.de>
Reviewed-by: Oliver Klee <typo3-coding@oliverklee.de>
Reviewed-by: Mathias Brodala <mbrodala@pagemachine.de>
Reviewed-by: tomalo.stuttgart <loeffler@spooner-web.de>
Reviewed-by: Rudy Gnodde <rgn@windinternet.nl>
Reviewed-by: Kevin Meckl <kevin.meckl@zdrei.com>
Reviewed-by: Richard Haeser <richard@maxserv.com>
Reviewed-by: Markus Klein <markus.klein@typo3.org>
Reviewed-by: Andreas Fernandez <a.fernandez@scripting-base.de>
typo3/sysext/core/Classes/IO/PharStreamWrapperInterceptor.php

index 3fd28de..23ba827 100644 (file)
@@ -20,6 +20,7 @@ use TYPO3\CMS\Core\Utility\GeneralUtility;
 use TYPO3\PharStreamWrapper\Assertable;
 use TYPO3\PharStreamWrapper\Exception;
 use TYPO3\PharStreamWrapper\Manager;
+use TYPO3\PharStreamWrapper\Resolver\PharInvocationResolver;
 
 class PharStreamWrapperInterceptor implements Assertable
 {
@@ -49,7 +50,7 @@ class PharStreamWrapperInterceptor implements Assertable
      */
     protected function isAllowed(string $path): bool
     {
-        $invocation = Manager::instance()->resolve($path);
+        $invocation = Manager::instance()->resolve($path, PharInvocationResolver::RESOLVE_ALIAS);
         if ($invocation === null) {
             return false;
         }