[TYPO3-core] RFC #8715: Bug: non-Admins can not import pages from their own directory

[Johannes Pieper]

On Mon, 08 Sep 2008 12:39:36 +0200
Martin Kutschker <masi-no at spam-typo3.org> wrote:

> Johannes Pieper schrieb:
> > Hi,
> > 
> > On Sun, 07 Sep 2008 22:15:44 +0200
> > Martin Kutschker <masi-no at spam-typo3.org> wrote:
> > 
> >> Johannes Pieper schrieb:
> >>> Hi,
> >>>
> >>> Martin Kutschker <masi-no at spam-typo3.org> wrote:
> >>>> Johannes Pieper schrieb:
> >>>>> Hi,
> >>>>>
> >>>>> "Dmitry Dulepov [typo3]" <dmitry at typo3.org> wrote:
> >>>>>> Johannes Pieper wrote:
> >>>>>>> Problem:
> >>>>>>> A reporter (non admin) can't import pages, because the own directory,
> >>>>>>> where he can write files are not listing in the importfield
> >>>>>>>
> >>>>>>> Solution:
> >>>>>>> Set Path to search for Import-Files to the "userSaveFolder", where user
> >>>>>>> can save their export files.
> >>>>>> Doesn't that mean people cannot import from fileadmin/ any more?
> >>>>> In the most case a reporter hasn't access to fileadmin/. With the old patch he can import data only from a place he could read and write.
> >>>>>
> >>>>> I have a new one, so that importfiles from the userSaveFolder merged to the importfiles in fileadmin/
> >>>> Why do you strstr()? 
> >>> For example $this->userSaveFolder(); returns /var/lib/typo3-dummy/fileadmin/test/
> >>> but t3lib_div::getFilesInDir(PATH_site.$userPath,'t3d,xml',1,1); only works with fileadmin/test/
> >>> so I have to delete the part before fileadmin.
> >> But userSaveFolder() will return already the absolute filepath required
> >> for getFilesInDir(). No need to alter the path in any way, or do I miss
> >> anything?
> > 
> > Yes, you did. getFilesInDir doesn't work with absolute filepath. So I have to alter the path.
> 
> But you use t3lib_div::getFilesInDir(PATH_site.$path). This is an
> absoulte path, right?

Yes, I was blind, sorry.

Correct patch is in attach

Joh

-- 
Deutsche Lebens-Rettungs-Gesellschaft e.V. - Präsidium
Johannes Pieper
Arbeitskreis Internet
E-Mail: Pieper at DLRG.de
http://www.DLRG.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: patch_8715_6.diff
Type: text/x-patch
Size: 1438 bytes
Desc: not available
Url : http://lists.netfielders.de/pipermail/typo3-team-core/attachments/20080908/03c4a263/attachment.bin