Hello,
v2025
I have an error when uploading files. I think it is after the update v2025.0.2
League\Flysystem\PathTraversalDetected Path traversal detected: …/storage/files/temp__c9p1pcvokihs74mrc2eagoajhjsosiup/ads_own/x_bannerEn/{1E8EA205-7453-4F13-9F4B-175349A7C470}.png
What’s the reason?
Make sure you set the Upload folder correctly. From the docs:
The path is relative to project folder. Use slashes “/” as path delimiter, no leading slash, e.g. “uploads/”
Don’t start with ".." either.
I followed your suggestion, but I’m still unable to implement my approach. I’ve been using this method since version 5 of your program.
To recap, my application needs to reside in the directory domain/cp/.
Files should be stored in a directory adjacent to domain/storage/files/.
I need to record the remaining path in the database, excluding the root directory for files like advertising/banner/en/27-11-2024/1732711823.png.
The full file path should be domain/storage/files/advertising/banner/en/27-11-2024/1732711823.png.
I noticed in your example that a directory was created at domain/cp/storage/files/, which is not the intended behavior.
In you case you should:
".." (no quotes),"storage/files/" (no quotes if global upload folder)"https://domain/" (assume your site uses SSL) or "/" (no quotes).I’ve verified all 3 requirements. I’ve created a global directory within the PHP section. I’ve developed the logic for image uploads and relocations, but it’s encountering issues. The global directory is being generated inside the /cp/ directory, while I need it one directory above. Post-upload, a “temp_klws09slwowmsll” directory is created, yet the intended image directory is not being generated. The process of relocating the uploaded image to the parent directory and renaming it is unclear. The previous implementation in the older program version is not working.
My code:
function Row_Inserting(?array $oldRow, array &$newRow): ?bool
{
$baseFolders = [
"uploads/journal/"
];
// Configuration for creating folders
$folderConfig = [
'permissions' => 0777,
];
// Check and create base folders and date-specific subfolders
foreach ($baseFolders as $baseFolder) {
// Check if the base folder exists, if not, create it
if (!DirectoryExists($baseFolder)) {
CreateDirectory($baseFolder, $folderConfig);
Log("Base folder created: " . $baseFolder);
} else {
Log("Base folder already exists: " . $baseFolder);
}
// Build the path for the date-specific folder
$datedFolder = $baseFolder . date("d-m-Y") . "/";
// Check if the date-specific folder exists, if not, create it
if (!DirectoryExists($datedFolder)) {
CreateDirectory($datedFolder, $folderConfig);
Log("Date-specific folder created: " . $datedFolder);
} else {
Log("Date-specific folder already exists: " . $datedFolder);
}
}
// Processing the image file
if (!empty($newRow["image"])) {
$fileName = $newRow["image"];
$fileExtension = strtolower(pathinfo($fileName, PATHINFO_EXTENSION)); // Extract and normalize file extension
// Define new relative and absolute paths for the file
$newRelativePath = "journal/" . date("d-m-Y") . "/" . time() . "." . $fileExtension;
$sourcePath = "uploads/" . $fileName;
$destinationPath = "uploads/journal/" . date("d-m-Y") . "/" . time() . "." . $fileExtension;
// Attempt to move the file to the new location
if (MoveFile($sourcePath, $destinationPath)) {
$newRow["image"] = $newRelativePath; // Update the path in the data row
Log("Image file successfully moved to: " . $destinationPath);
} else {
Log("Error moving the image file.");
}
}
return true;
}
That’s why you need to:
There are various problems in your code.
You tried to copy file from $sourcePath = "uploads/" . $fileName, but there is no uploaded file under “uploads/” unless you have set the global upload path to "uploads/", but you want to store files under "storage/files/". Even you set that to "uploads/", the actual path of the temp uploaded file is under "uploads/temp_xxx".
In fact, you do not need to move uploaded file yourself, after inserting the uploaded files will be moved to the field’s upload path + file name, so you should be able to move by prefixing the partial path to the file name only.
You copied the file to $destinationPath ("uploads/journal/xxx.ext") but you set the image as $newRelativePath ("journal/xxx.ext"). That will not work unless the field’s upload path is set to "uploads/".
If you want duplicate the file to your "uploads/journal/<date>" folder, you may access the temp file by $this->image->Upload->getTempFile() (assume the field name is “image” and the field is single file upload only), or you may use $this->image->Upload->saveToFile($destinationPath).
".." or "../"?I set the local file system root to ".." (without quotes).
PHP - General Options - Upload folder - uploads/
For example, uploads/
function Row_Inserting(?array $oldRow, array &$newRow): ?bool
{
// Processing the image file
if (!empty($newRow["image"])) {
$fileName = $newRow["image"];
$fileExtension = strtolower(pathinfo($fileName, PATHINFO_EXTENSION)); // Extract and normalize file extension
// Define new relative and absolute paths for the file
$newRelativePath = "journal/" . date("d-m-Y") . "/" . time() . "." . $fileExtension;
$newRow["image"] = $newRelativePath; // Update the path in the data row
}
return true;
}
Correct.
That means your folder is <Project Folder>/../uploads, e.g. if your project folder is set to D:\mysites\cp, then the global upload folder is D:\mysites\uploads. If you did not set the field’s upload folder, the global upload folder will be used.
If you still want to copy files yourself, you may use $this->image->Upload->saveToFile("...") as suggeted, but that will create two files, one at where you saved, the other under the global upload folder. The preferred way may be creating another field to store the file path, e.g. “FilePath”, then you may specify the field’s upload folder as "uploads/journal/" . $this->FilePath->DbValue, and in your server event set the date to the “FilePath” field and rename the file as "<time>.<ext>" only, e.g.
$this->FilePath->setDbValueDef($newRow, date("d-m-Y") . "/");
$newRow["image"] = time() . "." . $fileExtension;
I have the same result.
And how to rename the file.
For the locale I indicate two dots.
// Base directory configuration
$uploadBaseDir = "uploads/journal/";
$folderConfig = ['permissions' => 0777]; // Default permissions for folders
// Check if image is provided
if (isset($newRow["image"])) {
// Extract file extension
$fileExtension = strtolower(pathinfo($newRow["image"], PATHINFO_EXTENSION));
// Generate relative folder and file names
$dateFolder = date("d-m-Y") . "/";
$newFileName = time() . "." . $fileExtension;
// Build relative and absolute paths
$relativePath = $dateFolder . $newFileName; // Path stored in database
$absolutePath = $uploadBaseDir . $relativePath; // Full physical path
// Ensure the date-based folder exists
$absoluteDateFolder = $uploadBaseDir . $dateFolder; // Full folder path
if (!DirectoryExists($absoluteDateFolder)) {
CreateDirectory($absoluteDateFolder, $folderConfig);
Log("Created directory: " . $absoluteDateFolder);
} else {
Log("Directory already exists: " . $absoluteDateFolder);
}
// Temporary file from the upload system
$tempFilePath = $this->image->Upload->getTempFile();
// Move the file to the new location
if (MoveFile($tempFilePath, $absolutePath)) {
Log("File successfully moved to: " . $absolutePath);
// Save the relative path for database usage
$newRow["image"] = $relativePath;
Log("File path saved in database: " . $relativePath);
} else {
Log("Failed to move file from $tempFilePath to $absolutePath");
}
}
Click Tools → Update Template to update to the latest template and try again.
It is worsk very good as need for me)
This is my final cide
if (!empty($newRow["image"])) {
$fileName = $newRow["image"];
$fileExtension = strtolower(pathinfo($fileName, PATHINFO_EXTENSION)); // Extract and normalize file extension
$newRelativePath = "journal/" . date("d-m-Y") . "/" . time() . "." . $fileExtension;
$newRow["image"] = $newRelativePath; // Update the path in the data row
}