Nemcio/Grav-Admin-Plugin
1
0
Fork 0
mirror of https://github.com/getgrav/grav-plugin-admin.git synced 2026-01-20 06:22:59 +01:00
Code Issues Packages Projects Releases Activity

Fixed a glitch which allows user to delete entire pages directory [#1941]

Browse Source
This commit is contained in:
Matias Griese
2020-08-28 13:34:40 +03:00
parent 0a1908f1b5
commit e1a487bd88
2 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
classes/admincontroller.php
View File

@@ -487,6 +487,11 @@ class AdminController extends AdminBaseController
$data = (array)$this->data;
$folder = $data['folder'] ?? '';
if ($folder === '' || mb_strpos($folder, '/') !== false) {
throw new \RuntimeException('Creating folder failed, bad folder name', 400);
}
if ($data['route'] === '/') {
$path = $this->grav['locator']->findResource('page://');
} else {
@@ -494,7 +499,7 @@ class AdminController extends AdminBaseController
}
$orderOfNewFolder = static::getNextOrderInFolder($path);
$new_path = $path . '/' . $orderOfNewFolder . '.' . $data['folder'];
$new_path = $path . '/' . $orderOfNewFolder . '.' . $folder;
Folder::create($new_path);
Cache::clearCache('invalidate');
@@ -585,6 +590,11 @@ class AdminController extends AdminBaseController
/** @var PageInterface $obj */
$obj = $this->admin->page(true);
$folder = $data['folder'] ?? null;
if ($folder === '' || mb_strpos($folder, '/') !== false) {
throw new \RuntimeException('Saving page failed: bad folder name', 400);
}
if (!isset($data['folder']) || !$data['folder']) {
$data['folder'] = $obj->slug();
$this->data['folder'] = $obj->slug();
@@ -814,6 +824,10 @@ class AdminController extends AdminBaseController
$folder = \Grav\Plugin\Admin\Utils::slug($data[substr($folder, 9)]);
}
$folder = ltrim($folder, '_');
if ($folder === '' || mb_strpos($folder, '/') !== false) {
throw new \RuntimeException('Creating page failed: bad folder name', 400);
}
if (!empty($data['modular'])) {
$folder = '_' . $folder;
}