Nemcio/Grav-Admin-Plugin
1
0
Fork 0
mirror of https://github.com/getgrav/grav-plugin-admin.git synced 2025-11-12 16:26:07 +01:00
Code Issues Packages Projects Releases Activity

Tightened checks when removing a media file, cleanup

Browse Source
This commit is contained in:
Matias Griese
2020-11-06 15:05:33 +02:00
parent b9ac46fd13
commit a6f0f4945f
4 changed files with 10 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGELOG.md
View File

@@ -6,6 +6,10 @@
* Allow to fallback to `docs:` instead of `readme:`
* Backported finder/pages navigation from 1.10 (you will still need 1.10 for the fancy Parent Picker)
* Forward a `sid` to GPM when downloading a premium package
1. [](#bugfix)
* Fixed unused task RemoveMedia, it cannot be used directly anymore
* Tightened checks when removing a media file
* Removed unused parameter in file field
# v1.9.17
## 10/07/2020

11
classes/adminbasecontroller.php
View File

@@ -913,11 +913,11 @@ class AdminBaseController
$uri = $this->grav['uri'];
$blueprint = base64_decode($uri->param('blueprint'));
$path = base64_decode($uri->param('path'));
$filename = basename($this->post['filename'] ?? '');
$proute = base64_decode($uri->param('proute'));
$route = base64_decode($uri->param('proute'));
$type = $uri->param('type');
$field = $uri->param('field');
$filename = basename($this->post['filename'] ?? '');
if ($filename === '') {
$this->admin->json_response = [
'status' => 'error',
@@ -929,7 +929,7 @@ class AdminBaseController
// Get Blueprint
if ($type === 'pages' || strpos($blueprint, 'pages/') === 0) {
$page = $this->admin->page(true, $proute);
$page = $this->admin->page(true, $route);
if (!$page) {
$this->admin->json_response = [
'status' => 'error',
@@ -1039,10 +1039,7 @@ class AdminBaseController
}
if (null === $filename) {
$filename = base64_decode($this->grav['uri']->param('route'));
if (!$filename) {
$filename = base64_decode($this->route);
}
throw new \RuntimeException('Admin task RemoveMedia has been disabled.');
}
$file = File::instance($filename);

8
classes/admincontroller.php
View File

@@ -1821,14 +1821,10 @@ class AdminController extends AdminBaseController
return false;
}
$filename = !empty($this->post['filename']) ? $this->post['filename'] : null;
$filename = !empty($this->post['filename']) ? basename($this->post['filename']) : null;
// Handle bad filenames.
if (!Utils::checkFilename($filename)) {
$filename = null;
}
if (!$filename) {
if (!$filename || !Utils::checkFilename($filename)) {
$this->admin->json_response = [
'status' => 'error',
'message' => $this->admin::translate('PLUGIN_ADMIN.NO_FILE_FOUND')

1
themes/grav/templates/forms/fields/file/file.html.twig
View File

@@ -40,7 +40,6 @@
{% set remove = global.file_task_remove ? global.file_url_remove : uri.addNonce(
global.file_url_remove ~
'/media.json' ~
'/route' ~ config.system.param_sep ~ base64_encode(global.base_path ~ '/' ~ real_path) ~
'/task' ~ config.system.param_sep ~ 'removeFileFromBlueprint' ~
'/proute' ~ config.system.param_sep ~ base64_encode(route) ~
'/blueprint' ~ config.system.param_sep ~ blueprint ~