Skip to content

Commit

Permalink
Fixed #13756
Browse files Browse the repository at this point in the history
  • Loading branch information
brandonkelly committed Sep 29, 2023
1 parent a6b900e commit 8d0cfc1
Show file tree
Hide file tree
Showing 2 changed files with 40 additions and 47 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@

## Unreleased

- Fixed a bug where the `defaultDirMode` config setting wasn’t being respected when the `storage/runtime/` and `storage/logs/` folders were created. ([#13756](https://github.com/craftcms/cms/issues/13756))
- Fixed an RCE vulnerability.

## 3.9.4 - 2023-09-26
Expand Down
86 changes: 39 additions & 47 deletions bootstrap/bootstrap.php
Original file line number Diff line number Diff line change
Expand Up @@ -7,23 +7,27 @@
* @license https://craftcms.github.io/license/
*/

use craft\config\GeneralConfig;
use craft\helpers\App;
use craft\helpers\ArrayHelper;
use craft\helpers\FileHelper;
use craft\services\Config;
use yii\base\ErrorException;

// Get the last error at the earliest opportunity, so we can catch max_input_vars errors
// see https://stackoverflow.com/a/21601349/1688568
$lastError = error_get_last();

// Setup
// Validate the app type
// -----------------------------------------------------------------------------

// Validate the app type
if (!isset($appType) || ($appType !== 'web' && $appType !== 'console')) {
throw new Exception('$appType must be set to "web" or "console".');
}

// Determine the paths
// -----------------------------------------------------------------------------

$findConfig = function($constName, $argName) {
if (defined($constName)) {
return constant($constName);
Expand All @@ -48,20 +52,40 @@
return $path ? realpath($path) : null;
};

$createFolder = function($path) {
// Code borrowed from Io...
if (!is_dir($path)) {
$oldumask = umask(0);
// Set the vendor path. By default assume that it's 4 levels up from here
$vendorPath = $findConfigPath('CRAFT_VENDOR_PATH', 'vendorPath') ?: dirname(__DIR__, 3);

if (!mkdir($path, 0755, true)) {
// Set a 503 response header so things like Varnish won't cache a bad page.
http_response_code(503);
exit('Tried to create a folder at ' . $path . ', but could not.' . PHP_EOL);
}
// Set the "project root" path that contains config/, storage/, etc. By default assume that it's up a level from vendor/.
$rootPath = $findConfigPath('CRAFT_BASE_PATH', 'basePath') ?: dirname($vendorPath);

// By default the remaining directories will be in the base directory
$configPath = $findConfigPath('CRAFT_CONFIG_PATH', 'configPath') ?: $rootPath . DIRECTORY_SEPARATOR . 'config';
$contentMigrationsPath = $findConfigPath('CRAFT_CONTENT_MIGRATIONS_PATH', 'contentMigrationsPath') ?: $rootPath . DIRECTORY_SEPARATOR . 'migrations';
$storagePath = $findConfigPath('CRAFT_STORAGE_PATH', 'storagePath') ?: $rootPath . DIRECTORY_SEPARATOR . 'storage';
$templatesPath = $findConfigPath('CRAFT_TEMPLATES_PATH', 'templatesPath') ?: $rootPath . DIRECTORY_SEPARATOR . 'templates';
$translationsPath = $findConfigPath('CRAFT_TRANSLATIONS_PATH', 'translationsPath') ?: $rootPath . DIRECTORY_SEPARATOR . 'translations';
$testsPath = $findConfigPath('CRAFT_TESTS_PATH', 'testsPath') ?: $rootPath . DIRECTORY_SEPARATOR . 'tests';

// Set the environment
// -----------------------------------------------------------------------------

// Because setting permission with mkdir is a crapshoot.
chmod($path, 0755);
umask($oldumask);
$environment = $findConfig('CRAFT_ENVIRONMENT', 'env') ?: ($_SERVER['SERVER_NAME'] ?? null);

// Load the general config
// -----------------------------------------------------------------------------

$configService = new Config();
$configService->env = $environment;
$configService->configDir = $configPath;
$configService->appDefaultsDir = dirname(__DIR__) . DIRECTORY_SEPARATOR . 'src' . DIRECTORY_SEPARATOR . 'config' . DIRECTORY_SEPARATOR . 'defaults';
$generalConfig = $configService->getConfigFromFile('general');

// Validation
// -----------------------------------------------------------------------------

$createFolder = function($path) use ($generalConfig) {
if (!is_dir($path)) {
FileHelper::createDirectory($path, $generalConfig['defaultDirMode'] ?? 0775);
}
};

Expand All @@ -82,29 +106,6 @@
}
};

// Determine the paths
// -----------------------------------------------------------------------------

// Set the vendor path. By default assume that it's 4 levels up from here
$vendorPath = $findConfigPath('CRAFT_VENDOR_PATH', 'vendorPath') ?: dirname(__DIR__, 3);

// Set the "project root" path that contains config/, storage/, etc. By default assume that it's up a level from vendor/.
$rootPath = $findConfigPath('CRAFT_BASE_PATH', 'basePath') ?: dirname($vendorPath);

// By default the remaining directories will be in the base directory
$configPath = $findConfigPath('CRAFT_CONFIG_PATH', 'configPath') ?: $rootPath . DIRECTORY_SEPARATOR . 'config';
$contentMigrationsPath = $findConfigPath('CRAFT_CONTENT_MIGRATIONS_PATH', 'contentMigrationsPath') ?: $rootPath . DIRECTORY_SEPARATOR . 'migrations';
$storagePath = $findConfigPath('CRAFT_STORAGE_PATH', 'storagePath') ?: $rootPath . DIRECTORY_SEPARATOR . 'storage';
$templatesPath = $findConfigPath('CRAFT_TEMPLATES_PATH', 'templatesPath') ?: $rootPath . DIRECTORY_SEPARATOR . 'templates';
$translationsPath = $findConfigPath('CRAFT_TRANSLATIONS_PATH', 'translationsPath') ?: $rootPath . DIRECTORY_SEPARATOR . 'translations';
$testsPath = $findConfigPath('CRAFT_TESTS_PATH', 'testsPath') ?: $rootPath . DIRECTORY_SEPARATOR . 'tests';

// Set the environment
$environment = $findConfig('CRAFT_ENVIRONMENT', 'env') ?: ($_SERVER['SERVER_NAME'] ?? null);

// Validate the paths
// -----------------------------------------------------------------------------

if (!defined('CRAFT_LICENSE_KEY') && !App::isEphemeral()) {
// Validate permissions on the license key file path (default config/) and storage/
if (defined('CRAFT_LICENSE_KEY_PATH')) {
Expand Down Expand Up @@ -164,19 +165,10 @@

error_reporting(E_ALL & ~E_DEPRECATED & ~E_USER_DEPRECATED);

// Load the general config
// -----------------------------------------------------------------------------

$configService = new Config();
$configService->env = $environment;
$configService->configDir = $configPath;
$configService->appDefaultsDir = dirname(__DIR__) . DIRECTORY_SEPARATOR . 'src' . DIRECTORY_SEPARATOR . 'config' . DIRECTORY_SEPARATOR . 'defaults';
$generalConfig = $configService->getConfigFromFile('general');

// Determine if Craft is running in Dev Mode
// -----------------------------------------------------------------------------

$devMode = ArrayHelper::getValue($generalConfig, 'devMode', false);
$devMode = $generalConfig['devMode'] ?? false;

if ($devMode) {
ini_set('display_errors', 1);
Expand Down

0 comments on commit 8d0cfc1

Please sign in to comment.