ImportFilePath
in package
Single place that builds the absolute path in `privateDir` from the stored relative path of a job.
IMPORTANT: filePath of a job could be overwritten through the generic save API with
../../anything and the manager joined it as $base . '/' . ltrim($path, '/'). ltrim strips only
leading slashes, not ../, so cleanup (unlink) and parser/log reads could leave privateDir.
Only the shape generated by the admin upload is valid
(ProductImportAddFormTrait::moveUploadedImportFile()):
eshop/product-imports/YYYY/MM/DD/<10 chars a-z0-9>/<file name>, optionally with a log or summary
extension after the name. The name must not contain a slash or start with a dot, so .. cannot
occur. When the job directory exists on disk, it must lie under the import root after realpath
(symlinks).
Table of Contents
Constants
- ROOT : string = 'eshop/product-imports'
- PATTERN : string = '~^eshop/product-imports/\d{4}/\d{2}/\d{2}/[a-z...
Methods
- absolute() : string|null
- Returns the absolute path under `$privateDir`, or `null` when the relative path does not match the job shape or would (via a symlink) lead outside the import root. `null` means do not touch the file.
- isValid() : bool
Constants
ROOT
public
string
ROOT
= 'eshop/product-imports'
PATTERN
private
string
PATTERN
= '~^eshop/product-imports/\d{4}/\d{2}/\d{2}/[a-z0-9]{10}/[A-Za-z0-9_-][A-Za-z0-9._-]*$~D'
Methods
absolute()
Returns the absolute path under `$privateDir`, or `null` when the relative path does not match the job shape or would (via a symlink) lead outside the import root. `null` means do not touch the file.
public
static absolute(string $privateDir, string $relative) : string|null
Parameters
- $privateDir : string
- $relative : string
Return values
string|nullisValid()
public
static isValid(string $relative) : bool
Parameters
- $relative : string