Skip to content
This repository was archived by the owner on Apr 29, 2019. It is now read-only.

Commit 2409365

Browse files
svitjasvitja
committed
Merge remote-tracking branch 'origin/MAGETWO-83579' into 2.3-develop-pr2
2 parents b335fe7 + cd8fb3b commit 2409365

File tree

12 files changed

+704
-17
lines changed

12 files changed

+704
-17
lines changed

‎app/code/Magento/Cms/Controller/Adminhtml/Wysiwyg/Images/DeleteFiles.php

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@
77

88
use Magento\Framework\App\Filesystem\DirectoryList;
99

10+
/**
11+
* Delete image files.
12+
*/
1013
class DeleteFiles extends \Magento\Cms\Controller\Adminhtml\Wysiwyg\Images
1114
{
1215
/**
@@ -19,29 +22,40 @@ class DeleteFiles extends \Magento\Cms\Controller\Adminhtml\Wysiwyg\Images
1922
*/
2023
protected $resultRawFactory;
2124

25+
/**
26+
* @var \Magento\Framework\App\Filesystem\DirectoryResolver
27+
*/
28+
private $directoryResolver;
29+
2230
/**
2331
* Constructor
2432
*
2533
* @param \Magento\Backend\App\Action\Context $context
2634
* @param \Magento\Framework\Registry $coreRegistry
2735
* @param \Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory
2836
* @param \Magento\Framework\Controller\Result\RawFactory $resultRawFactory
37+
* @param \Magento\Framework\App\Filesystem\DirectoryResolver|null $directoryResolver
2938
*/
3039
public function __construct(
3140
\Magento\Backend\App\Action\Context $context,
3241
\Magento\Framework\Registry $coreRegistry,
3342
\Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory,
34-
\Magento\Framework\Controller\Result\RawFactory $resultRawFactory
43+
\Magento\Framework\Controller\Result\RawFactory $resultRawFactory,
44+
\Magento\Framework\App\Filesystem\DirectoryResolver $directoryResolver = null
3545
) {
46+
parent::__construct($context, $coreRegistry);
47+
3648
$this->resultRawFactory = $resultRawFactory;
3749
$this->resultJsonFactory = $resultJsonFactory;
38-
parent::__construct($context, $coreRegistry);
50+
$this->directoryResolver = $directoryResolver
51+
?: $this->_objectManager->get(\Magento\Framework\App\Filesystem\DirectoryResolver::class);
3952
}
4053

4154
/**
42-
* Delete file from media storage
55+
* Delete file from media storage.
4356
*
4457
* @return \Magento\Framework\Controller\ResultInterface
58+
* @throws \Magento\Framework\Exception\LocalizedException
4559
*/
4660
public function execute()
4761
{
@@ -54,6 +68,11 @@ public function execute()
5468
/** @var $helper \Magento\Cms\Helper\Wysiwyg\Images */
5569
$helper = $this->_objectManager->get(\Magento\Cms\Helper\Wysiwyg\Images::class);
5670
$path = $this->getStorage()->getSession()->getCurrentPath();
71+
if (!$this->directoryResolver->validatePath($path, DirectoryList::MEDIA)) {
72+
throw new \Magento\Framework\Exception\LocalizedException(
73+
__('Directory %1 is not under storage root path.', $path)
74+
);
75+
}
5776
foreach ($files as $file) {
5877
$file = $helper->idDecode($file);
5978
/** @var \Magento\Framework\Filesystem $filesystem */
@@ -64,11 +83,13 @@ public function execute()
6483
$this->getStorage()->deleteFile($filePath);
6584
}
6685
}
86+
6787
return $this->resultRawFactory->create();
6888
} catch (\Exception $e) {
6989
$result = ['error' => true, 'message' => $e->getMessage()];
7090
/** @var \Magento\Framework\Controller\Result\Json $resultJson */
7191
$resultJson = $this->resultJsonFactory->create();
92+
7293
return $resultJson->setData($result);
7394
}
7495
}

‎app/code/Magento/Cms/Controller/Adminhtml/Wysiwyg/Images/DeleteFolder.php

Lines changed: 25 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,11 @@
66
*/
77
namespace Magento\Cms\Controller\Adminhtml\Wysiwyg\Images;
88

9+
use Magento\Framework\App\Filesystem\DirectoryList;
10+
11+
/**
12+
* Delete image folder.
13+
*/
914
class DeleteFolder extends \Magento\Cms\Controller\Adminhtml\Wysiwyg\Images
1015
{
1116
/**
@@ -18,38 +23,55 @@ class DeleteFolder extends \Magento\Cms\Controller\Adminhtml\Wysiwyg\Images
1823
*/
1924
protected $resultRawFactory;
2025

26+
/**
27+
* @var \Magento\Framework\App\Filesystem\DirectoryResolver
28+
*/
29+
private $directoryResolver;
30+
2131
/**
2232
* @param \Magento\Backend\App\Action\Context $context
2333
* @param \Magento\Framework\Registry $coreRegistry
2434
* @param \Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory
2535
* @param \Magento\Framework\Controller\Result\RawFactory $resultRawFactory
36+
* @param \Magento\Framework\App\Filesystem\DirectoryResolver|null $directoryResolver
2637
*/
2738
public function __construct(
2839
\Magento\Backend\App\Action\Context $context,
2940
\Magento\Framework\Registry $coreRegistry,
3041
\Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory,
31-
\Magento\Framework\Controller\Result\RawFactory $resultRawFactory
42+
\Magento\Framework\Controller\Result\RawFactory $resultRawFactory,
43+
\Magento\Framework\App\Filesystem\DirectoryResolver $directoryResolver = null
3244
) {
45+
parent::__construct($context, $coreRegistry);
3346
$this->resultRawFactory = $resultRawFactory;
3447
$this->resultJsonFactory = $resultJsonFactory;
35-
parent::__construct($context, $coreRegistry);
48+
$this->directoryResolver = $directoryResolver
49+
?: $this->_objectManager->get(\Magento\Framework\App\Filesystem\DirectoryResolver::class);
3650
}
3751

3852
/**
39-
* Delete folder action
53+
* Delete folder action.
4054
*
4155
* @return \Magento\Framework\Controller\ResultInterface
56+
* @throws \Magento\Framework\Exception\LocalizedException
4257
*/
4358
public function execute()
4459
{
4560
try {
4661
$path = $this->getStorage()->getCmsWysiwygImages()->getCurrentPath();
62+
if (!$this->directoryResolver->validatePath($path, DirectoryList::MEDIA)) {
63+
throw new \Magento\Framework\Exception\LocalizedException(
64+
__('Directory %1 is not under storage root path.', $path)
65+
);
66+
}
4767
$this->getStorage()->deleteDirectory($path);
68+
4869
return $this->resultRawFactory->create();
4970
} catch (\Exception $e) {
5071
$result = ['error' => true, 'message' => $e->getMessage()];
5172
/** @var \Magento\Framework\Controller\Result\Json $resultJson */
5273
$resultJson = $this->resultJsonFactory->create();
74+
5375
return $resultJson->setData($result);
5476
}
5577
}

‎app/code/Magento/Cms/Controller/Adminhtml/Wysiwyg/Images/NewFolder.php

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,44 +6,65 @@
66
*/
77
namespace Magento\Cms\Controller\Adminhtml\Wysiwyg\Images;
88

9+
use Magento\Framework\App\Filesystem\DirectoryList;
10+
11+
/**
12+
* Creates new folder.
13+
*/
914
class NewFolder extends \Magento\Cms\Controller\Adminhtml\Wysiwyg\Images
1015
{
1116
/**
1217
* @var \Magento\Framework\Controller\Result\JsonFactory
1318
*/
1419
protected $resultJsonFactory;
1520

21+
/**
22+
* @var \Magento\Framework\App\Filesystem\DirectoryResolver
23+
*/
24+
private $directoryResolver;
25+
1626
/**
1727
* @param \Magento\Backend\App\Action\Context $context
1828
* @param \Magento\Framework\Registry $coreRegistry
1929
* @param \Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory
30+
* @param \Magento\Framework\App\Filesystem\DirectoryResolver|null $directoryResolver
2031
*/
2132
public function __construct(
2233
\Magento\Backend\App\Action\Context $context,
2334
\Magento\Framework\Registry $coreRegistry,
24-
\Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory
35+
\Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory,
36+
\Magento\Framework\App\Filesystem\DirectoryResolver $directoryResolver = null
2537
) {
26-
$this->resultJsonFactory = $resultJsonFactory;
2738
parent::__construct($context, $coreRegistry);
39+
$this->resultJsonFactory = $resultJsonFactory;
40+
$this->directoryResolver = $directoryResolver
41+
?: $this->_objectManager->get(\Magento\Framework\App\Filesystem\DirectoryResolver::class);
2842
}
2943

3044
/**
31-
* New folder action
45+
* New folder action.
3246
*
3347
* @return \Magento\Framework\Controller\ResultInterface
48+
* @throws \Magento\Framework\Exception\LocalizedException
3449
*/
3550
public function execute()
3651
{
3752
try {
3853
$this->_initAction();
3954
$name = $this->getRequest()->getPost('name');
4055
$path = $this->getStorage()->getSession()->getCurrentPath();
56+
if (!$this->directoryResolver->validatePath($path, DirectoryList::MEDIA)) {
57+
throw new \Magento\Framework\Exception\LocalizedException(
58+
__('Directory %1 is not under storage root path.', $path)
59+
);
60+
}
4161
$result = $this->getStorage()->createDirectory($name, $path);
4262
} catch (\Exception $e) {
4363
$result = ['error' => true, 'message' => $e->getMessage()];
4464
}
4565
/** @var \Magento\Framework\Controller\Result\Json $resultJson */
4666
$resultJson = $this->resultJsonFactory->create();
67+
4768
return $resultJson->setData($result);
4869
}
4970
}

‎app/code/Magento/Cms/Controller/Adminhtml/Wysiwyg/Images/Upload.php

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,43 +6,64 @@
66
*/
77
namespace Magento\Cms\Controller\Adminhtml\Wysiwyg\Images;
88

9+
use Magento\Framework\App\Filesystem\DirectoryList;
10+
11+
/**
12+
* Upload image.
13+
*/
914
class Upload extends \Magento\Cms\Controller\Adminhtml\Wysiwyg\Images
1015
{
1116
/**
1217
* @var \Magento\Framework\Controller\Result\JsonFactory
1318
*/
1419
protected $resultJsonFactory;
1520

21+
/**
22+
* @var \Magento\Framework\App\Filesystem\DirectoryResolver
23+
*/
24+
private $directoryResolver;
25+
1626
/**
1727
* @param \Magento\Backend\App\Action\Context $context
1828
* @param \Magento\Framework\Registry $coreRegistry
1929
* @param \Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory
30+
* @param \Magento\Framework\App\Filesystem\DirectoryResolver|null $directoryResolver
2031
*/
2132
public function __construct(
2233
\Magento\Backend\App\Action\Context $context,
2334
\Magento\Framework\Registry $coreRegistry,
24-
\Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory
35+
\Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory,
36+
\Magento\Framework\App\Filesystem\DirectoryResolver $directoryResolver = null
2537
) {
26-
$this->resultJsonFactory = $resultJsonFactory;
2738
parent::__construct($context, $coreRegistry);
39+
$this->resultJsonFactory = $resultJsonFactory;
40+
$this->directoryResolver = $directoryResolver
41+
?: $this->_objectManager->get(\Magento\Framework\App\Filesystem\DirectoryResolver::class);
2842
}
2943

3044
/**
31-
* Files upload processing
45+
* Files upload processing.
3246
*
3347
* @return \Magento\Framework\Controller\ResultInterface
48+
* @throws \Magento\Framework\Exception\LocalizedException
3449
*/
3550
public function execute()
3651
{
3752
try {
3853
$this->_initAction();
39-
$targetPath = $this->getStorage()->getSession()->getCurrentPath();
40-
$result = $this->getStorage()->uploadFile($targetPath, $this->getRequest()->getParam('type'));
54+
$path = $this->getStorage()->getSession()->getCurrentPath();
55+
if (!$this->directoryResolver->validatePath($path, DirectoryList::MEDIA)) {
56+
throw new \Magento\Framework\Exception\LocalizedException(
57+
__('Directory %1 is not under storage root path.', $path)
58+
);
59+
}
60+
$result = $this->getStorage()->uploadFile($path, $this->getRequest()->getParam('type'));
4161
} catch (\Exception $e) {
4262
$result = ['error' => $e->getMessage(), 'errorcode' => $e->getCode()];
4363
}
4464
/** @var \Magento\Framework\Controller\Result\Json $resultJson */
4565
$resultJson = $this->resultJsonFactory->create();
66+
4667
return $resultJson->setData($result);
4768
}
4869
}

‎app/code/Magento/Cms/Test/Unit/Model/Wysiwyg/Images/StorageTest.php

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ protected function setUp()
127127

128128
$this->directoryMock = $this->createPartialMock(
129129
\Magento\Framework\Filesystem\Directory\Write::class,
130-
['delete', 'getDriver', 'create']
130+
['delete', 'getDriver', 'create', 'getRelativePath', 'isExist']
131131
);
132132
$this->directoryMock->expects(
133133
$this->any()
@@ -151,7 +151,7 @@ protected function setUp()
151151
$this->adapterFactoryMock = $this->createMock(\Magento\Framework\Image\AdapterFactory::class);
152152
$this->imageHelperMock = $this->createPartialMock(
153153
\Magento\Cms\Helper\Wysiwyg\Images::class,
154-
['getStorageRoot']
154+
['getStorageRoot', 'getCurrentPath']
155155
);
156156
$this->imageHelperMock->expects(
157157
$this->any()
@@ -182,7 +182,10 @@ protected function setUp()
182182
$this->uploaderFactoryMock = $this->getMockBuilder(\Magento\MediaStorage\Model\File\UploaderFactory::class)
183183
->disableOriginalConstructor()
184184
->getMock();
185-
$this->sessionMock = $this->createMock(\Magento\Backend\Model\Session::class);
185+
$this->sessionMock = $this->getMockBuilder(\Magento\Backend\Model\Session::class)
186+
->setMethods(['getCurrentPath'])
187+
->disableOriginalConstructor()
188+
->getMock();
186189
$this->backendUrlMock = $this->createMock(\Magento\Backend\Model\Url::class);
187190

188191
$this->coreFileStorageMock = $this->getMockBuilder(\Magento\MediaStorage\Helper\File\Storage\Database::class)

0 commit comments

Comments
 (0)