diff --git a/VERSIONS_HOTLINE/73474 b/VERSIONS_HOTLINE/73474 new file mode 100644 index 0000000000000000000000000000000000000000..7208611c3d72457bddfd4bd90a8283c295b9bb47 --- /dev/null +++ b/VERSIONS_HOTLINE/73474 @@ -0,0 +1,2 @@ + - ticket #73474 : Explorateur de fichiers : les dossiers ajoutés directement dans le dossier "userfiles" sont mainteant visible. + \ No newline at end of file diff --git a/library/Class/FileManager.php b/library/Class/FileManager.php index 09cdbc3c6c072191221d2d023d137bedbed1ee4b..0e54e9bb82f688929288be6caab61d4189f7bada 100644 --- a/library/Class/FileManager.php +++ b/library/Class/FileManager.php @@ -223,7 +223,20 @@ class Class_FileManager extends Class_Entity { if ($user->isSuperAdmin()) return true; - return preg_match('/^' . USERFILES . '\/(bannieres|css|file|flash|image|js)/', $path); + $restrcited_path = ['album', + 'etageres', + 'flash', + 'i18n', + 'photobib', + 'temp', + 'versions', + 'web_thumbnails']; + + foreach($restrcited_path as $restrcited) + if(USERFILES . '/' . $restrcited == $path) + return false; + + return true; } diff --git a/tests/application/modules/admin/controllers/FileManagerControllerTest.php b/tests/application/modules/admin/controllers/FileManagerControllerTest.php index b82ea59064f7ee823b7145273d34ef046ef2efe7..ecdfeb53cfbaa748e90af589e38b2dfeaa2e5967 100644 --- a/tests/application/modules/admin/controllers/FileManagerControllerTest.php +++ b/tests/application/modules/admin/controllers/FileManagerControllerTest.php @@ -1584,4 +1584,43 @@ class FileManagerControllerWithSpecialCharTest extends FileManagerControllerTest public function urlPublicShouldBePrenset() { $this->assertXPathContentContains('//dd', '/userfiles/my \'direct"ory/new\'_ima"ge.jpg'); } +} + + + + +class FileManagerControllerRigthsOnPathTest extends ModelTestCase { + protected $_storm_default_to_volatile = true; + + + public function setUp() { + parent::setUp(); + $admin = $this->fixture('Class_Users', + ['id' => 3, + 'login' => 'admin', + 'password' => 'admin']); + $admin->beAdminPortail(); + ZendAfi_Auth::getInstance()->logUser($admin); + } + + + public function getPaths() { + return [ + [true, 'userfiles'], + [true, 'userfiles/custom'], + [true, 'userfiles/image'], + [true, 'userfiles/album_1'], + [false, 'userfiles/album'], + [false, 'custom'] + ]; + } + + + /** + * @dataProvider getPaths + * @test + */ + public function checkRightsOnPath($has_right, $path) { + $this->assertEquals($has_right, Class_FileManager::userHasRightOnPath($path)); + } } \ No newline at end of file