Upgrade 1-11.38

vendor/studio-42/elfinder/php/elFinder.class.php

@@ -32,7 +32,7 @@ class elFinder
      *
      * @var integer
      */
-    protected static $ApiRevision = 65;
+    protected static $ApiRevision = 66;
 
     /**
      * Storages (root dirs)
@@ -421,9 +421,9 @@ class elFinder
 
     /**
      * LAN class allowed when uploading via URL
-     * 
+     *
      * Array keys are 'local', 'private_a', 'private_b', 'private_c' and 'link'
-     * 
+     *
      * local:     127.0.0.0/8
      * private_a: 10.0.0.0/8
      * private_b: 172.16.0.0/12
@@ -606,16 +606,22 @@ class elFinder
         $this->version = (string)self::$ApiVersion;
 
         // set error handler of WARNING, NOTICE
-        $errLevel = E_WARNING | E_NOTICE | E_USER_WARNING | E_USER_NOTICE | E_STRICT | E_RECOVERABLE_ERROR;
+        $errLevel = E_WARNING | E_NOTICE | E_USER_WARNING | E_USER_NOTICE | E_RECOVERABLE_ERROR;
         if (defined('E_DEPRECATED')) {
             $errLevel |= E_DEPRECATED | E_USER_DEPRECATED;
         }
+        // E_STRICT is deprecated; see https://wiki.php.net/rfc/deprecations_php_8_4#remove_e_strict_error_level_and_deprecate_e_strict_constant
+        if (defined('E_STRICT')) {
+            $errLevel |= @E_STRICT;
+        }
         set_error_handler('elFinder::phpErrorHandler', $errLevel);
 
         // Associative array of file pointers to close at the end of script: ['temp file pointer' => true]
         $GLOBALS['elFinderTempFps'] = array();
         // Associative array of files to delete at the end of script: ['temp file path' => true]
         $GLOBALS['elFinderTempFiles'] = array();
+         // Associative array of abort files to delete at the end of script: ['temp file path' => true]
+        $GLOBALS['elFinderAbortFiles'] = array();
         // regist Shutdown function
         register_shutdown_function(array('elFinder', 'onShutdown'));
 
@@ -1999,18 +2005,17 @@ class elFinder
         if ($onetime) {
             $volume = null;
             $tmpdir = elFinder::$commonTempPath;
-            if (!$tmpdir || !is_file($tmpf = $tmpdir . DIRECTORY_SEPARATOR . 'ELF' . $target)) {
+            if (!$tmpdir || !is_file($tmpf = $tmpdir . DIRECTORY_SEPARATOR . 'ELF' . basename($target))) {
                 return $a404;
             }
             $GLOBALS['elFinderTempFiles'][$tmpf] = true;
             if ($file = json_decode(file_get_contents($tmpf), true)) {
-                $src = base64_decode($file['file']);
+                $src = $tmpdir . DIRECTORY_SEPARATOR . basename(base64_decode($file['file']));
                 if (!is_file($src) || !($fp = fopen($src, 'rb'))) {
                     return $a404;
                 }
-                if (strpos($src, $tmpdir) === 0) {
-                    $GLOBALS['elFinderTempFiles'][$src] = true;
-                }
+                $GLOBALS['elFinderTempFiles'][$src] = true;
+                
                 unset($file['file']);
                 $file['read'] = true;
                 $file['size'] = filesize($src);
@@ -2564,7 +2569,7 @@ class elFinder
         if (!empty($args['makeFile'])) {
             self::$abortCheckFile = sprintf($flagFile, self::filenameDecontaminate($args['makeFile']));
             touch(self::$abortCheckFile);
-            $GLOBALS['elFinderTempFiles'][self::$abortCheckFile] = true;
+            $GLOBALS['elFinderAbortFiles'][self::$abortCheckFile] = true;
             return;
         }
 
@@ -2706,7 +2711,6 @@ class elFinder
             curl_setopt($ch, CURLOPT_FILE, $outfp);
         } else {
             curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-            curl_setopt($ch, CURLOPT_BINARYTRANSFER, true);
         }
         curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, 1);
         curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, $timeout);
@@ -4184,7 +4188,7 @@ var go = function() {
         }
     } catch(e) {
         // for CORS
-        w.postMessage && w.postMessage(JSON.stringify({bind:\'' . $bind . '\',data:' . $json . '}), \'' . $origin . '\');
+        w.postMessage && w.postMessage(JSON.stringify({type:\'io.studio-42.github\',bind:\'' . $bind . '\',data:' . $json . '}), \'' . $origin . '\');
     }
     close();
     setTimeout(function() {
@@ -4288,17 +4292,18 @@ var go = function() {
                 $proc = true;
                 break;
 
-            case E_STRICT:
-                elFinder::$phpErrors[] = "STRICT: $errstr in $errfile line $errline.";
-                $proc = true;
-                break;
-
             case E_RECOVERABLE_ERROR:
                 elFinder::$phpErrors[] = "RECOVERABLE_ERROR: $errstr in $errfile line $errline.";
                 $proc = true;
                 break;
         }
 
+        // E_STRICT is deprecated; see https://wiki.php.net/rfc/deprecations_php_8_4#remove_e_strict_error_level_and_deprecate_e_strict_constant
+        if (defined('E_STRICT') && $errno === @E_STRICT) {
+            elFinder::$phpErrors[] = "STRICT: $errstr in $errfile line $errline.";
+            $proc = true;
+        }
+
         if (defined('E_DEPRECATED')) {
             switch ($errno) {
                 case E_DEPRECATED:
@@ -5226,7 +5231,7 @@ var go = function() {
             $name = str_replace('\\', '/', $name);
         }
         $parts = explode('/', trim($name, '/'));
-        $name = array_pop($parts); 
+        $name = array_pop($parts);
         return $name;
     }
 
@@ -5373,11 +5378,26 @@ var go = function() {
                 is_resource($fp) && fclose($fp);
             }
         }
+         //Delete temp file paths
         if (!empty($GLOBALS['elFinderTempFiles'])) {
             foreach (array_keys($GLOBALS['elFinderTempFiles']) as $f) {
-                is_file($f) && is_writable($f) && unlink($f);
+                //Make sure paths are safe before deleting them
+                $tf = elFinder::$commonTempPath . DIRECTORY_SEPARATOR . basename($f);
+                is_file($tf) && is_writable($tf) && unlink($tf);
             }
+            unset($f);
         }
+
+        //Delete abort file paths
+        if(!empty($GLOBALS['elFinderAbortFiles'])) {
+            foreach (array_keys($GLOBALS['elFinderAbortFiles']) as $f) {
+                //Make sure paths are safe before deleting them
+                $tf = elFinder::$connectionFlagsPath . DIRECTORY_SEPARATOR . basename($f);
+                is_file($tf) && is_writable($tf) && unlink($tf);
+            }
+            unset($f);
+        }
+
     }
 
     /**

vendor/studio-42/elfinder/php/elFinderVolumeDriver.class.php

@@ -3331,7 +3331,7 @@ abstract class elFinderVolumeDriver
             }
         }
         if (empty($file['url']) && $this->URL) {
-            $path = str_replace($this->separator, '/', substr($this->decode($hash), strlen(rtrim($this->root, '/' . $this->separator)) + 1));
+            $path = str_replace($this->separator, '/', substr($this->decode($hash), strlen(trim($this->root, '/' . $this->separator))));
             if ($this->encoding) {
                 $path = $this->convEncIn($path, true);
             }
@@ -3462,9 +3462,8 @@ abstract class elFinderVolumeDriver
             $tempPath = elFinder::getStaticVar('commonTempPath');
         } else if (function_exists('sys_get_temp_dir')) {
             $tempPath = sys_get_temp_dir();
-        } else if ($this->tmbPathWritable) {
-            $tempPath = $this->tmbPath;
         }
+        
         if ($tempPath && DIRECTORY_SEPARATOR !== '/') {
             $tempPath = str_replace('/', DIRECTORY_SEPARATOR, $tempPath);
         }
@@ -5329,7 +5328,15 @@ abstract class elFinderVolumeDriver
         $this->rmTmb($stat); // can not do rmTmb() after _move()
         $this->clearcache();
 
-        if ($res = $this->convEncOut($this->_move($this->convEncIn($src), $this->convEncIn($dst), $this->convEncIn($name)))) {
+        $res = $this->convEncOut($this->_move($this->convEncIn($src), $this->convEncIn($dst), $this->convEncIn($name)));
+        // if moving it didn't work try to copy / delete
+        if (!$res) {
+            if ($this->copy($src, $dst, $name)) {
+                $res = $this->remove($src);
+            }
+        }
+
+        if ($res) {
             $this->clearstatcache();
             if ($stat['mime'] === 'directory') {
                 $this->updateSubdirsCache($dst, true);

vendor/studio-42/elfinder/php/elFinderVolumeDropbox2.class.php

@@ -363,7 +363,7 @@ class elFinderVolumeDropbox2 extends elFinderVolumeDriver
                     if ($code && $state) {
                         if (!empty($options['id'])) {
                             // see https://github.com/kunalvarma05/dropbox-php-sdk/issues/115
-                            $authHelper->getPersistentDataStore()->set('state', filter_var($state, FILTER_SANITIZE_STRING));
+                            $authHelper->getPersistentDataStore()->set('state', htmlspecialchars($state));
                             $tokenObj = $authHelper->getAccessToken($code, $state, $callback);
                             $options['tokens'] = [
                                 'access_token' => $tokenObj->getToken(),

vendor/studio-42/elfinder/php/elFinderVolumeOneDrive.class.php

@@ -1357,8 +1357,9 @@ class elFinderVolumeOneDrive extends elFinderVolumeDriver
                 if ($result) {
                     $result = json_decode($result);
                     if (isset($result->link)) {
-                        list(, $res) = explode('?', $result->link->webUrl);
-                        $res = 'https://onedrive.live.com/download.aspx?' . $res;
+                        // list(, $res) = explode('?', $result->link->webUrl);
+                        // $res = 'https://onedrive.live.com/download.aspx?' . $res;
+                        $res = $result->link->webUrl;
                     }
                 }
             } catch (Exception $e) {

vendor/studio-42/elfinder/php/elFinderVolumeSFTPphpseclib.class.php

@@ -9,6 +9,12 @@
  **/
 class elFinderVolumeSFTPphpseclib extends elFinderVolumeFTP {
 
+    /**
+     * Simple hack that could break for quick compatibility with phpseclib version 1-3
+     * Same value substitue for reference NET_SFTP_LOCAL_FILE and SFTP::SOURCE_LOCAL_FILE
+     */
+    const NET_SFTP_LOCAL_FILE = 1;
+
     /**
      * Constructor
      * Extend options with required fields
@@ -237,6 +243,10 @@ class elFinderVolumeSFTPphpseclib extends elFinderVolumeFTP {
         }
 
         $name = $info['filename'];
+        //for compatability with phpseclib version 2/3
+        if (empty($info['permissions'])) {
+            $info['permissions'] = $info['mode'];
+        }   
 
         if ($info['type'] === 3) {
             // check recursive processing
@@ -307,7 +317,7 @@ class elFinderVolumeSFTPphpseclib extends elFinderVolumeFTP {
     protected function parsePermissions($permissions, $isowner = true)
     {
         $permissions = decoct($permissions);
-        $perm = $isowner ? decbin($permissions[-3]) : decbin($permissions[-1]);
+        $perm = $isowner ? decbin((int)$permissions[-3]) : decbin((int)$permissions[-1]);
 
         return array(
             'read' => $perm[-3],
@@ -612,7 +622,7 @@ class elFinderVolumeSFTPphpseclib extends elFinderVolumeFTP {
         if ($this->tmp) {
             $path = $this->_joinPath($path, $name);
             $local = $this->getTempFile();
-            $res = touch($local) && $this->connect->put($path, $local, NET_SFTP_LOCAL_FILE);
+            $res = touch($local) && $this->connect->put($path, $local, self::NET_SFTP_LOCAL_FILE);
             unlink($local);
             return $res ? $path : false;
         }
@@ -640,7 +650,7 @@ class elFinderVolumeSFTPphpseclib extends elFinderVolumeFTP {
             $local = $this->getTempFile();
 
             if ($this->connect->get($source, $local)
-                && $this->connect->put($target, $local, NET_SFTP_LOCAL_FILE)) {
+                && $this->connect->put($target, $local, self::NET_SFTP_LOCAL_FILE)) {
                 $res = true;
             }
             unlink($local);