{"action":"created","issue":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/7216","labels_url":"https://api.github.com/repos/joomla/joomla-cms/issues/7216/labels{/name}","comments_url":"https://api.github.com/repos/joomla/joomla-cms/issues/7216/comments","events_url":"https://api.github.com/repos/joomla/joomla-cms/issues/7216/events","html_url":"https://github.com/joomla/joomla-cms/issues/7216","id":89688517,"number":7216,"title":"JPath::find() does not find symbolic linked files","user":{"login":"Erftralle","id":10573985,"avatar_url":"https://avatars.githubusercontent.com/u/10573985?v=3","gravatar_id":"","url":"https://api.github.com/users/Erftralle","html_url":"https://github.com/Erftralle","followers_url":"https://api.github.com/users/Erftralle/followers","following_url":"https://api.github.com/users/Erftralle/following{/other_user}","gists_url":"https://api.github.com/users/Erftralle/gists{/gist_id}","starred_url":"https://api.github.com/users/Erftralle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Erftralle/subscriptions","organizations_url":"https://api.github.com/users/Erftralle/orgs","repos_url":"https://api.github.com/users/Erftralle/repos","events_url":"https://api.github.com/users/Erftralle/events{/privacy}","received_events_url":"https://api.github.com/users/Erftralle/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/joomla/joomla-cms/labels/No%20Code%20Attached%20Yet","name":"No Code Attached Yet","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-06-20T00:07:36Z","updated_at":"2015-06-23T14:12:52Z","closed_at":null,"body":"Since I am developing Joomla! extensions (environment Xampp for Windows, Eclipse, Git) I am always proceeding the same way. I clone a project to my desktop outside my web folder (e.g. C:\\Sources\\GitHub\\joomla-cms) and establish symbolic links from my web folder to the cloned project (e.g. C:\\xampp\\htdocs\\joomla-cms <==> C:\\Sources\\GitHub\\joomla-cms).\r\n\r\nThis worked fine for me and with this method I had the possibility to have other clones (e.g. an extension like JoomGallery) in the same Joomla! installation by establishing similar links (working together with the help of git exclude) and there was no interference of the various clones. I am doing so for some years and I never detected any problems with it, until today. I cloned a project containing alternate layouts for an extension (JoomGallery) and proceeded the same way explained above. But the layout was never applied. I found out, that the problem was caused by the use of the symbolic links. The linked files were not detected by Joomla! because the use of ```realpath()``` in ```JPath::find()```\r\n```\r\n\t\t// Start looping through the path set\r\n\t\tforeach ($paths as $path)\r\n\t\t{\r\n\t\t\t// Get the path to the file\r\n\t\t\t$fullname = $path . '/' . $file;\r\n\r\n\t\t\t// Is the path based on a stream?\r\n\t\t\tif (strpos($path, '://') === false)\r\n\t\t\t{\r\n\t\t\t\t// Not a stream, so do a realpath() to avoid directory\r\n\t\t\t\t// traversal attempts on the local file system.\r\n\r\n\t\t\t\t// Needed for substr() later\r\n\t\t\t\t$path = realpath($path);\r\n\t\t\t\t$fullname = realpath($fullname);\r\n\t\t\t}\r\n\r\n\t\t\t/*\r\n\t\t\t * The substr() check added to make sure that the realpath()\r\n\t\t\t * results in a directory registered so that\r\n\t\t\t * non-registered directories are not accessible via directory\r\n\t\t\t * traversal attempts.\r\n\t\t\t */\r\n\t\t\tif (file_exists($fullname) && substr($fullname, 0, strlen($path)) == $path )\r\n\t\t\t{\r\n\t\t\t\treturn $fullname;\r\n\t\t\t}\r\n```\r\ndoes prevent that. As a result of that the default layouts were applied (without giving any error message). For me, this is a bug or at least not the job of Joomla! to prevent the use of symbolic links (see Apache FollowSymLinks). Nearly 99% of my Joomla! installation is working perfect in a symbolic linked directory (as long JPath::find() is not involved).\r\nWhat do you think?"},"comment":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/comments/114519124","html_url":"https://github.com/joomla/joomla-cms/issues/7216#issuecomment-114519124","issue_url":"https://api.github.com/repos/joomla/joomla-cms/issues/7216","id":114519124,"user":{"login":"instance","id":2599327,"avatar_url":"https://avatars.githubusercontent.com/u/2599327?v=3","gravatar_id":"","url":"https://api.github.com/users/instance","html_url":"https://github.com/instance","followers_url":"https://api.github.com/users/instance/followers","following_url":"https://api.github.com/users/instance/following{/other_user}","gists_url":"https://api.github.com/users/instance/gists{/gist_id}","starred_url":"https://api.github.com/users/instance/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/instance/subscriptions","organizations_url":"https://api.github.com/users/instance/orgs","repos_url":"https://api.github.com/users/instance/repos","events_url":"https://api.github.com/users/instance/events{/privacy}","received_events_url":"https://api.github.com/users/instance/received_events","type":"User","site_admin":false},"created_at":"2015-06-23T14:12:52Z","updated_at":"2015-06-23T14:12:52Z","body":"I believe the intention here is to prevent compromised code from accessing files outside of the web root. Any extension that accepts a path from user input would be vulnerable to this sort of compromise. This in turn could lead to cross-site hacks when the same user has more than one site under the same account.\r\n\r\nI suppose we could add an option to override this behaviour, but having it there by default is intentional and IMO it is quite reasonable. Instead we should probably work on fixing the other 99% that allows symlinks."}}