From 1b3d67b39583a550cf4d6755090e87de4545c1d3 Mon Sep 17 00:00:00 2001 From: Lucas Crisman Date: Wed, 11 Mar 2015 18:19:38 -0300 Subject: [PATCH 1/2] temp virus scan dir move to tmp/ rather than uploads/ --- config.php | 2 +- controllers/File.php | 5 ++++- controllers/Upload.php | 5 +---- lib/classes/ScanAssets.php | 4 ++-- setup.sh | 10 +--------- 5 files changed, 9 insertions(+), 17 deletions(-) diff --git a/config.php b/config.php index bc40151f..f51c8a52 100644 --- a/config.php +++ b/config.php @@ -58,7 +58,6 @@ function defineOnce($key, $value) { if (!defined('APP_LOCATION')) define('APP_LOCATION',substr($_SERVER['SCRIPT_NAME'], 1, strrpos($_SERVER['SCRIPT_NAME'], '/'))); if (!defined('APP_BASE')) define('APP_BASE',substr(APP_LOCATION, 0, strrpos(APP_LOCATION, '/', -2))); if (!defined('APP_PATH')) define('APP_PATH', realpath(dirname(__FILE__))); -if (!defined('UPLOAD_PATH')) define('UPLOAD_PATH', realpath(APP_PATH . '/uploads')); if (!defined('LIB_PATH')) define('LIB_PATH', realpath(APP_PATH . '/lib')); if (!defined('CLASSES_PATH')) define('CLASSES_PATH', realpath(LIB_PATH . '/classes')); @@ -1309,6 +1308,7 @@ function defineOnce($key, $value) { defineOnce('CONTROLLERS_DIR', dirname(__FILE__) . '/controllers'); defineOnce('MUSTACHE_DIR', VIEWS_DIR . '/mustache'); defineOnce('TEMP_DIR', dirname(__FILE__) . '/tmp'); +defineOnce('VIRUS_SCAN_DIR', TEMP_DIR . '/uploads'); defineOnce('CACHE_DIR', TEMP_DIR . '/cache'); defineOnce('DEFAULT_CONTROLLER_NAME', 'Home'); diff --git a/controllers/File.php b/controllers/File.php index 688736ec..24a06e66 100644 --- a/controllers/File.php +++ b/controllers/File.php @@ -52,7 +52,10 @@ public function add($reference = '', $isW9 = false) { $ext = end(explode(".", $name)); $fileName = File::uniqueFilename($ext); } - $path = UPLOAD_PATH . '/' . $fileName; + if (!is_dir(VIRUS_SCAN_DIR)) { + mkdir(VIRUS_SCAN_DIR, 0750); + } + $path = VIRUS_SCAN_DIR . '/' . $fileName; $dest = fopen($path, 'w'); while (!feof($source)) { diff --git a/controllers/Upload.php b/controllers/Upload.php index 352cba86..62c35e83 100644 --- a/controllers/Upload.php +++ b/controllers/Upload.php @@ -4,10 +4,7 @@ class UploadController extends Controller { public $view = null; function run($filename) { - $path = UPLOAD_PATH . DIRECTORY_SEPARATOR . $filename; - if (!is_readable($path)) { - $path = APP_ATTACHMENT_URL . $filename; - } + $path = APP_ATTACHMENT_URL . $filename; $finfo = new finfo(FILEINFO_MIME); $content = file_get_contents($path); $file = new File(); diff --git a/lib/classes/ScanAssets.php b/lib/classes/ScanAssets.php index 4c9e8992..7af6fb3d 100644 --- a/lib/classes/ScanAssets.php +++ b/lib/classes/ScanAssets.php @@ -102,7 +102,7 @@ public function scanFile($id) { $file_name = pathinfo(parse_url($row['url'],PHP_URL_PATH),PATHINFO_BASENAME); // Get the full path and prepare it for the command line. - $real_path = UPLOAD_PATH . '/' . $file_name; + $real_path = VIRUS_SCAN_DIR . '/' . $file_name; $safe_path = escapeshellarg($real_path); // Reset the values. $return = -1; @@ -113,7 +113,7 @@ public function scanFile($id) { if (!empty($safe_path) && file_exists($real_path) && filesize($real_path) > 0 ) { // Execute the command. exec ($cmd, $out, $return); - + error_log('VIRUS_SCAN: ' . $cmd . ' --- ' . $return); if ($return == 0) { //if clean update db $sql = 'UPDATE `' . FILES . '` SET is_scanned = 1, scan_result = 0 WHERE `id` = ' . $id; $notify = ''; diff --git a/setup.sh b/setup.sh index 66324bf0..c8f00d05 100755 --- a/setup.sh +++ b/setup.sh @@ -12,7 +12,6 @@ SERVER_NAME=${WORKLIST_SERVER_NAME:="dev.worklist.net"} SERVER_CONFIG=$CURRENT_PATH/server.local.php CUSTOM_CONFIG=${WORKLIST_CUSTOM_CONFIG:=""} TMP_PATH=${WORKLIST_TMP_PATH:=$CURRENT_PATH/tmp} -UPLOADS_PATH=${WORKLIST_UPLOADS_PATH:=$CURRENT_PATH/uploads} DEBUG_FILE=${WORKLIST_DEBUG_FILE:=$CURRENT_PATH/php.errors} # We assume that developers works on their own forked repos @@ -76,11 +75,4 @@ fi cp .htaccess_default .htaccess sed -i s/~unixusername/~$CURRENT_USER/g .htaccess sed -i s/sandboxdir/$SANDBOX_NAME/g .htaccess -sed -i s/#RewriteBase/RewriteBase/g .htaccess - -# Uploads dir: same than tmp -if [ ! -d $UPLOADS_PATH ] -then - mkdir $UPLOADS_PATH -fi -chmod -R 777 $UPLOADS_PATH +sed -i s/#RewriteBase/RewriteBase/g .htaccess \ No newline at end of file From cb630c156c3b5b8739e23f8df3e74362947adfb7 Mon Sep 17 00:00:00 2001 From: Lucas Crisman Date: Wed, 11 Mar 2015 18:20:43 -0300 Subject: [PATCH 2/2] debugging line removal --- lib/classes/ScanAssets.php | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/classes/ScanAssets.php b/lib/classes/ScanAssets.php index 7af6fb3d..968d394a 100644 --- a/lib/classes/ScanAssets.php +++ b/lib/classes/ScanAssets.php @@ -113,7 +113,6 @@ public function scanFile($id) { if (!empty($safe_path) && file_exists($real_path) && filesize($real_path) > 0 ) { // Execute the command. exec ($cmd, $out, $return); - error_log('VIRUS_SCAN: ' . $cmd . ' --- ' . $return); if ($return == 0) { //if clean update db $sql = 'UPDATE `' . FILES . '` SET is_scanned = 1, scan_result = 0 WHERE `id` = ' . $id; $notify = '';