Nemcio/Grav-Admin-Plugin
1
0
Fork 0
mirror of https://github.com/getgrav/grav-plugin-admin.git synced 2025-11-12 16:26:07 +01:00
Code Issues Packages Projects Releases Activity

Tightened checks when removing a media file, cleanup

Browse Source
This commit is contained in:
Matias Griese
2020-11-06 15:05:33 +02:00
parent b9ac46fd13
commit a6f0f4945f
4 changed files with 10 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGELOG.md
View File

@@ -6,6 +6,10 @@
* Allow to fallback to `docs:` instead of `readme:` * Allow to fallback to `docs:` instead of `readme:`
* Backported finder/pages navigation from 1.10 (you will still need 1.10 for the fancy Parent Picker) * Backported finder/pages navigation from 1.10 (you will still need 1.10 for the fancy Parent Picker)
* Forward a `sid` to GPM when downloading a premium package * Forward a `sid` to GPM when downloading a premium package
1. [](#bugfix)
* Fixed unused task RemoveMedia, it cannot be used directly anymore
* Tightened checks when removing a media file
* Removed unused parameter in file field
# v1.9.17 # v1.9.17
## 10/07/2020 ## 10/07/2020

11
classes/adminbasecontroller.php
View File

@@ -913,11 +913,11 @@ class AdminBaseController
$uri = $this->grav['uri']; $uri = $this->grav['uri'];
$blueprint = base64_decode($uri->param('blueprint')); $blueprint = base64_decode($uri->param('blueprint'));
$path = base64_decode($uri->param('path')); $path = base64_decode($uri->param('path'));
$filename = basename($this->post['filename'] ?? ''); $route = base64_decode($uri->param('proute'));
$proute = base64_decode($uri->param('proute'));
$type = $uri->param('type'); $type = $uri->param('type');
$field = $uri->param('field'); $field = $uri->param('field');
$filename = basename($this->post['filename'] ?? '');
if ($filename === '') { if ($filename === '') {
$this->admin->json_response = [ $this->admin->json_response = [
'status' => 'error', 'status' => 'error',
@@ -929,7 +929,7 @@ class AdminBaseController
// Get Blueprint // Get Blueprint
if ($type === 'pages' || strpos($blueprint, 'pages/') === 0) { if ($type === 'pages' || strpos($blueprint, 'pages/') === 0) {
$page = $this->admin->page(true, $proute); $page = $this->admin->page(true, $route);
if (!$page) { if (!$page) {
$this->admin->json_response = [ $this->admin->json_response = [
'status' => 'error', 'status' => 'error',
@@ -1039,10 +1039,7 @@ class AdminBaseController
} }
if (null === $filename) { if (null === $filename) {
$filename = base64_decode($this->grav['uri']->param('route')); throw new \RuntimeException('Admin task RemoveMedia has been disabled.');
if (!$filename) {
$filename = base64_decode($this->route);
}
} }
$file = File::instance($filename); $file = File::instance($filename);

8
classes/admincontroller.php
View File

@@ -1821,14 +1821,10 @@ class AdminController extends AdminBaseController
return false; return false;
} }
$filename = !empty($this->post['filename']) ? $this->post['filename'] : null; $filename = !empty($this->post['filename']) ? basename($this->post['filename']) : null;
// Handle bad filenames. // Handle bad filenames.
if (!Utils::checkFilename($filename)) { if (!$filename || !Utils::checkFilename($filename)) {
$filename = null;
}
if (!$filename) {
$this->admin->json_response = [ $this->admin->json_response = [
'status' => 'error', 'status' => 'error',
'message' => $this->admin::translate('PLUGIN_ADMIN.NO_FILE_FOUND') 'message' => $this->admin::translate('PLUGIN_ADMIN.NO_FILE_FOUND')

1
themes/grav/templates/forms/fields/file/file.html.twig
View File

@@ -40,7 +40,6 @@
{% set remove = global.file_task_remove ? global.file_url_remove : uri.addNonce( {% set remove = global.file_task_remove ? global.file_url_remove : uri.addNonce(
global.file_url_remove ~ global.file_url_remove ~
'/media.json' ~ '/media.json' ~
'/route' ~ config.system.param_sep ~ base64_encode(global.base_path ~ '/' ~ real_path) ~
'/task' ~ config.system.param_sep ~ 'removeFileFromBlueprint' ~ '/task' ~ config.system.param_sep ~ 'removeFileFromBlueprint' ~
'/proute' ~ config.system.param_sep ~ base64_encode(route) ~ '/proute' ~ config.system.param_sep ~ base64_encode(route) ~
'/blueprint' ~ config.system.param_sep ~ blueprint ~ '/blueprint' ~ config.system.param_sep ~ blueprint ~