marijo/movmaker-webui
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Skip inaccessible MVLog input dirs

Browse source
This commit is contained in:
hbrain 2026-07-05 21:55:20 +02:00
parent 9a2e507c24
commit 048132bd8a
1 changed files with 15 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

18
admin.php
View file

@ -263,8 +263,18 @@ function ensure_input_dir_permissions($dir){
elseif (is_file($path)) @chmod($path, 0664); elseif (is_file($path)) @chmod($path, 0664);
} }
} }
function input_dirs($base){ $dirs = glob($base.'/*', GLOB_ONLYDIR) ?: []; foreach ($dirs as $dir) ensure_input_dir_permissions($dir); return $dirs; } function input_dir_accessible($dir){ return is_dir($dir) && !is_link($dir) && is_array(@scandir($dir)); }
function safe_input_dir($base, $name){ $name = basename((string)$name); $path = realpath($base . '/' . $name); $root = realpath($base); if (!$path || !$root || !str_starts_with($path, $root . DIRECTORY_SEPARATOR) || !is_dir($path)) throw new RuntimeException('Invalid input directory.'); ensure_input_dir_permissions($path); return $path; } function input_dirs($base){
$dirs = glob($base.'/*', GLOB_ONLYDIR) ?: [];
$out = [];
foreach ($dirs as $dir) {
ensure_input_dir_permissions($dir);
if (input_dir_accessible($dir)) $out[] = $dir;
else error_log('Skipping inaccessible input dir: ' . $dir);
}
return $out;
}
function safe_input_dir($base, $name){ $name = basename((string)$name); $path = realpath($base . '/' . $name); $root = realpath($base); if (!$path || !$root || !str_starts_with($path, $root . DIRECTORY_SEPARATOR) || !is_dir($path) || !input_dir_accessible($path)) throw new RuntimeException('Invalid or inaccessible input directory.'); ensure_input_dir_permissions($path); return $path; }
function article_id_is_valid($id){ return is_string($id) && preg_match('/^[0-9]{14}[a-f0-9]{16}$/', $id); } function article_id_is_valid($id){ return is_string($id) && preg_match('/^[0-9]{14}[a-f0-9]{16}$/', $id); }
function generate_article_id(){ return gmdate('YmdHis') . bin2hex(random_bytes(8)); } function generate_article_id(){ return gmdate('YmdHis') . bin2hex(random_bytes(8)); }
function read_article_id($dir){ function read_article_id($dir){
@ -668,7 +678,9 @@ function media_sort_datetime($path){
function list_files($dir){ function list_files($dir){
ensure_input_dir_permissions($dir); ensure_input_dir_permissions($dir);
$files = array_values(array_filter(scandir($dir), fn($f)=>editable_file($f) && is_file($dir.'/'.$f))); $items = @scandir($dir);
if (!is_array($items)) return [];
$files = array_values(array_filter($items, fn($f)=>editable_file($f) && is_file($dir.'/'.$f)));
$orderFile = $dir . '/order.json'; $orderFile = $dir . '/order.json';
$media = []; $media = [];