logic error in fcl-web-fpwebfile.pp, it works only in *nix-osses.
Original Reporter info from Mantis: SunyD @soner-a
-
Reporter name: Soner
Original Reporter info from Mantis: SunyD @soner-a
- Reporter name: Soner
Description:
Following code works in "procedure RegisterFileLocation" only in linux/unix osses, because on windows the paths starts like this 'C:' or '\':
if Copy(D,1,1)<>'/' then
D:=BaseDir+D;
I think this procedure has more logic errors because you cannot not serve a file like this:
localhost/index.html
You must register subfolder and serve files from subfolder like this:
localhost/somefolder/index.html
Steps to reproduce:
start this application:
program fphttpappserver;
uses
SysUtils, fphttpapp, fpwebfile;
begin
RegisterFileLocation('files',ExtractFilePath(ParamStr(0))+DirectorySeparator+'html');
{$ifdef WINDOWS}
MimeTypesFile:=ExtractFilePath(ParamStr(0))+'mime.types';
{$else}
MimeTypesFile:='/etc/mime.types';
{$endif}
Application.Initialize;
Application.Port:=80;
Application.Title:='010101';
Application.Run;
end.
Additional information:
I would change the code to this, because the function should not add application location as html folder, because it is security hole.
Procedure RegisterFileLocation(Const ALocation,ADirectory : String);
//Var
//D,BaseDir : String;
begin
if (ALocation='') then
Raise HTTPError.Create(SErrNoLocation);
if Pos('/',ALocation)<>0 then
Raise HTTPError.Create(SErrInvalidLocation);
if (Locations=Nil) then
Locations:=TStringList.Create;
if DefaultFileModuleClass=Nil then
DefaultFileModuleClass:=TFPCustomFileModule;
{BaseDir:=ExtractFilePath(ParamStr(0));
if (ADirectory='') then
Locations.Values[IncludeHTTPPathDelimiter(ALocation)]:=BaseDir
else
begin
D:=ADirectory;
if Copy(D,1,1)<>'/' then //<<-- WORKS ONLY IN LINUX/UNIX
D:=BaseDir+D;
if not DirectoryExists(D) then
Raise HTTPError.CreateFmt(SErrInvalidDirectory,[D]);
Locations.Values[IncludeHTTPPathDelimiter(ALocation)]:=IncludeTrailingPathDelimiter(D);
end;}
if not DirectoryExists(ADirectory) then
Raise HTTPError.CreateFmt(SErrInvalidDirectory,[ADirectory]);
Locations.Values[IncludeHTTPPathDelimiter(ALocation)]:=IncludeTrailingPathDelimiter(ADirectory);
RegisterHTTPModule(ALocation,DefaultFileModuleClass,true);
end;
Mantis conversion info:
- Mantis ID: 37727
- OS: Windows
- OS Build: 10
- Build: logic error in packages/fcl-web/
- Platform: x64
- Version: 3.3.1
- Fixed in version: 3.3.1
- Fixed in revision: 47350 (#b90d6e11)
- Monitored by: » @PascalDragon (Sven Barth)
- Target version: 3.2.2