[MGNLRES-60] Allow loading of file system resources from relative path Created: 24/May/13 Updated: 29/Mar/22 Resolved: 17/Jun/14 |
|
| Status: | Closed |
| Project: | Magnolia Resources Module |
| Component/s: | resourceLoaders |
| Affects Version/s: | 1.4.3, 2.0 |
| Fix Version/s: | 1.5.11, 2.2.5, 2.3.1 |
| Type: | New Feature | Priority: | Neutral |
| Reporter: | Nils Breunese | Assignee: | Roman Kovařík |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | next, support | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Issue Links: |
|
||||
| Template: |
|
||||
| Acceptance criteria: |
Empty
|
||||
| Team: | |||||
| Description |
|
Following from SUPPORT-1942 which we opened, This almost solves our use case, but sadly FileSystemResourceLoader currently doesn't allow using relative paths. Since our application has to work in many different environments, using absolute paths is not really an option. I believe that if on line 76 of FileSystemResourceLoader (version 1.5.10) 'path' would be changed to 'file.getCanonicalPath()' the feature would still be secure, but would also allow using relative paths. |
| Comments |
| Comment by Nils Breunese [ 16/Jun/14 ] |
|
Please use if (StringUtils.startsWith(template.getCanonicalPath(), file.getCanonicalPath())) {
instead of the current if (StringUtils.startsWith(template.getCanonicalPath(), path)) {
We are currently using a copy of FileSystemResourceLoader with this patch and now relative paths work, while this is still secure AFAIK. |
| Comment by Nils Breunese [ 16/Jun/14 ] |
|
We are currently using magnolia-module-resources version 1.5.10, so we'd appreciate this fix in 1.5.x. |