| Server IP : 85.13.141.101 / Your IP :
216.73.216.170 [
Web Server : Apache System : Linux dd40236 6.8.0-134-generic #134-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 26 18:43:11 UTC 2026 x86_64 User : w00ad34b ( 1052) PHP Version : 8.2.30-nmm1 Disable Function : NONE Domains : 429 Domains MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : OFF Directory : /www/htdocs/w00ad34b/pdf.rainer-gegner.de/libraries/src/Form/Rule/ |
Upload File : |
<?php
/**
* Joomla! Content Management System
*
* @copyright Copyright (C) 2005 - 2020 Open Source Matters, Inc. All rights reserved.
* @license GNU General Public License version 2 or later; see LICENSE.txt
*/
namespace Joomla\CMS\Form\Rule;
use Joomla\CMS\Form\Form;
use Joomla\CMS\Form\FormRule;
use Joomla\Filesystem\Path;
use Joomla\Registry\Registry;
// phpcs:disable PSR1.Files.SideEffects
\defined('_JEXEC') or die;
// phpcs:enable PSR1.Files.SideEffects
/**
* Form Rule class for the Joomla Platform.
*
* @since 3.9.21
*/
class FilePathRule extends FormRule
{
/**
* Method to test if the file path is valid
*
* @param \SimpleXMLElement $element The SimpleXMLElement object representing the `<field>` tag for the form field object.
* @param mixed $value The form field value to validate.
* @param string $group The field name group control value. This acts as an array container for the field.
* For example if the field has name="foo" and the group value is set to "bar" then the
* full field name would end up being "bar[foo]".
* @param ?Registry $input An optional Registry object with the entire data set to validate against the entire form.
* @param ?Form $form The form object for which the field is being tested.
*
* @return boolean True if the value is valid, false otherwise.
*
* @since 3.9.21
*/
public function test(\SimpleXMLElement $element, $value, $group = null, Registry $input = null, Form $form = null)
{
$value = trim($value);
// If the field is empty and not required, the field is valid.
$required = ((string) $element['required'] == 'true' || (string) $element['required'] == 'required');
if (!$required && empty($value)) {
return true;
}
// Get the exclude setting from the xml
$exclude = (array) explode('|', (string) $element['exclude']);
// Exclude current folder '.' to be safe from full path disclosure
$exclude[] = '.';
// Check the exclude setting
$path = preg_split('/[\/\\\\]/', $value);
if (\in_array(strtolower($path[0]), $exclude) || empty($path[0])) {
return false;
}
// Prepend the root path
$value = JPATH_ROOT . '/' . $value;
// Check if $value is a valid path, which includes not allowing to break out of the current path
try {
Path::check($value);
} catch (\Exception $e) {
// When there is an exception in the check path this is not valid
return false;
}
// When there are no exception this rule should pass.
// See: https://github.com/joomla/joomla-cms/issues/30500#issuecomment-683290162
return true;
}
}