if you check a file location in a non-existing directory it won't return FALSE.
file_check_location('files/x.jpg', 'non-existing-directory');// returns the real file path. not false.

is this intended behaviour? should we check the directory before sending to this functon?

One more thing; if the file does not exist, it gets the realpath of dirname($file) and it does not check if the directory exists
file_check_location('non-existing-directory/www', '/www'); //again not return false

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

drewish’s picture

Version: 6.x-dev » 7.x-dev

we ran into this trying to write unit tests for the hook_file patch (#142995: Add hook_file and make files into a 1st class Drupal object).

marked #261392: file_check_location() fails when file does not exist as a duplicate

drewish’s picture

Here's the test we built for this bug:

  function testFileCheckLocation() {
    $source = 'misc/fake/xyz.txt';
    $directory = 'misc';
    $result = file_check_location($source, $directory);
    $this->assertTrue($result, t("Non-existent file validates when checked for location in directory, but name contains a non-existent subfolder."), 'File');
  }

I'm forking it from #308434: Clean up file.inc ahead of hook_file and add unit tests. so that all the tests committed will pass.

p.brouwers’s picture

Status: Active » Needs review
FileSize
461 bytes

Made a patch for it.
See http://drupal.org/node/339863 also for D5 patch

Dries’s picture

drewish's test is not included in the patch?

p.brouwers’s picture

I don't get it. Should it?
Seems to me that Drewish's patch is already commit, and this patch can still be applied to it.

drewish’s picture

Status: Needs review » Needs work

p.brouwers no you need to incorporate the test that i'd posted in #3

p.brouwers’s picture

ah ok, will incorporate your test and submit a new patch

p.brouwers’s picture

FileSize
1.76 KB

ok, added your test drewish and corrected the other tests to reflect the change to file_check_location()

lacasuela’s picture

which file we must patch in drupal 6.8 and how?

sinasquax’s picture

I'm ok with the patch #9, webform module use file_check_location with /webform/ path in his file_download hook but it doesn't create the webform folder in sites/default/files.

So i get many "realpath() open_basedir restriction in effect" warnings.

p.brouwers’s picture

What's the current status on this subject?

praestigiare’s picture

FileSize
284 bytes

I am not sure if this is the correct place to put this, so forgive me if I am making a mistake. I made a patch for Drupal 6, with a slight modification: On windows systems, running realpath() on non-existent directories can be very slow in some cases. To avoid this, I moved the is_dir() check to before the realpath() call.

praestigiare’s picture

FileSize
298 bytes

Sorry - left out the directory info in the patch header.

Désiré’s picture

Status: Needs review » Needs work

Since the file_check_location function is removed from Drupal 7 this bug was not fixed, but it still effects Drupal 6 sites.

Varga Tamás’s picture

Version: 7.x-dev » 6.x-dev
Status: Needs work » Needs review
FileSize
428 bytes

Here is a current patch for 6.x drupal core

Status: Needs work » Needs review

Status: Needs review » Closed (outdated)

Automatically closed because Drupal 6 is no longer supported. If the issue verifiably applies to later versions, please reopen with details and update the version.