moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-06 01:16:44 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch 'MDL-59961_file_validation' of https://github.com/mrmark/moodle

Browse source
This commit is contained in:
David Monllao 2017-09-04 11:08:23 +02:00
commit 5700cf959e
2 changed files with 55 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

54
lib/filestorage/file_system.php
View file

@ -443,6 +443,60 @@ abstract class file_system {
return xsendfile($this->get_remote_path_from_hash($contenthash));
}
/**
* Validate that the content hash matches the content hash of the file on disk.
*
* @param string $contenthash The current content hash to validate
* @param string $pathname The path to the file on disk
* @return array The content hash (it might change) and file size
*/
protected function validate_hash_and_file_size($contenthash, $pathname) {
global $CFG;
if (!is_readable($pathname)) {
throw new file_exception('storedfilecannotread', '', $pathname);
}
$filesize = filesize($pathname);
if ($filesize === false) {
throw new file_exception('storedfilecannotread', '', $pathname);
}
if (is_null($contenthash)) {
$contenthash = file_storage::hash_from_path($pathname);
} else if ($CFG->debugdeveloper) {
$filehash = file_storage::hash_from_path($pathname);
if ($filehash === false) {
throw new file_exception('storedfilecannotread', '', $pathname);
}
if ($filehash !== $contenthash) {
// Hopefully this never happens, if yes we need to fix calling code.
debugging("Invalid contenthash submitted for file $pathname", DEBUG_DEVELOPER);
$contenthash = $filehash;
}
}
if ($contenthash === false) {
throw new file_exception('storedfilecannotread', '', $pathname);
}
if ($filesize > 0 and $contenthash === file_storage::hash_from_string('')) {
// Did the file change or is file_storage::hash_from_path() borked for this file?
clearstatcache();
$contenthash = file_storage::hash_from_path($pathname);
$filesize = filesize($pathname);
if ($contenthash === false or $filesize === false) {
throw new file_exception('storedfilecannotread', '', $pathname);
}
if ($filesize > 0 and $contenthash === file_storage::hash_from_string('')) {
// This is very weird...
throw new file_exception('storedfilecannotread', '', $pathname);
}
}
return [$contenthash, $filesize];
}
/**
* Add the supplied file to the file system.
*

42
lib/filestorage/file_system_filedir.php
View file

@ -344,48 +344,8 @@ class file_system_filedir extends file_system {
* @return array (contenthash, filesize, newfile)
*/
public function add_file_from_path($pathname, $contenthash = null) {
global $CFG;
if (!is_readable($pathname)) {
throw new file_exception('storedfilecannotread', '', $pathname);
}
$filesize = filesize($pathname);
if ($filesize === false) {
throw new file_exception('storedfilecannotread', '', $pathname);
}
if (is_null($contenthash)) {
$contenthash = file_storage::hash_from_path($pathname);
} else if ($CFG->debugdeveloper) {
$filehash = file_storage::hash_from_path($pathname);
if ($filehash === false) {
throw new file_exception('storedfilecannotread', '', $pathname);
}
if ($filehash !== $contenthash) {
// Hopefully this never happens, if yes we need to fix calling code.
debugging("Invalid contenthash submitted for file $pathname", DEBUG_DEVELOPER);
$contenthash = $filehash;
}
}
if ($contenthash === false) {
throw new file_exception('storedfilecannotread', '', $pathname);
}
if ($filesize > 0 and $contenthash === file_storage::hash_from_string('')) {
// Did the file change or is file_storage::hash_from_path() borked for this file?
clearstatcache();
$contenthash = file_storage::hash_from_path($pathname);
$filesize = filesize($pathname);
if ($contenthash === false or $filesize === false) {
throw new file_exception('storedfilecannotread', '', $pathname);
}
if ($filesize > 0 and $contenthash === file_storage::hash_from_string('')) {
// This is very weird...
throw new file_exception('storedfilecannotread', '', $pathname);
}
}
list($contenthash, $filesize) = $this->validate_hash_and_file_size($contenthash, $pathname);
$hashpath = $this->get_fulldir_from_hash($contenthash);
$hashfile = $this->get_local_path_from_hash($contenthash, false);