diff --git a/modules/cms/classes/Asset.php b/modules/cms/classes/Asset.php index 0bfc2eba8..9a83504ba 100644 --- a/modules/cms/classes/Asset.php +++ b/modules/cms/classes/Asset.php @@ -4,10 +4,11 @@ use File; use Lang; use Config; use Request; -use Cms\Helpers\File as FileHelper; -use October\Rain\Extension\Extendable; use ApplicationException; use ValidationException; +use Cms\Helpers\File as FileHelper; +use October\Rain\Extension\Extendable; +use October\Rain\Filesystem\PathResolver; /** * The CMS theme asset file class. @@ -287,14 +288,13 @@ class Asset extends Extendable $directory = $this->theme->getPath() . '/' . $this->dirName . '/'; $filePath = $directory . $fileName; - $resolvedPath = resolve_path($filePath); // Limit paths to those under the theme's assets directory - if (!starts_with($resolvedPath, $directory)) { + if (!PathResolver::within($filePath, $directory)) { return false; } - return $resolvedPath; + return PathResolver::resolve($filePath); } /** diff --git a/modules/cms/classes/CmsObject.php b/modules/cms/classes/CmsObject.php index 714650150..766f3726c 100644 --- a/modules/cms/classes/CmsObject.php +++ b/modules/cms/classes/CmsObject.php @@ -4,11 +4,12 @@ use App; use Lang; use Event; use Config; -use October\Rain\Halcyon\Model as HalcyonModel; -use Cms\Contracts\CmsObject as CmsObjectContract; -use ApplicationException; -use ValidationException; use Exception; +use ValidationException; +use ApplicationException; +use Cms\Contracts\CmsObject as CmsObjectContract; +use October\Rain\Filesystem\PathResolver; +use October\Rain\Halcyon\Model as HalcyonModel; /** * This is a base class for all CMS objects - content files, pages, partials and layouts. @@ -229,14 +230,13 @@ class CmsObject extends HalcyonModel implements CmsObjectContract $directory = $this->theme->getPath() . '/' . $this->getObjectTypeDirName() . '/'; $filePath = $directory . $fileName; - $resolvedPath = resolve_path($filePath); // Limit paths to those under the corresponding theme directory - if (!starts_with($resolvedPath, $directory)) { + if (!PathResolver::within($filePath, $directory)) { return false; } - return $resolvedPath; + return PathResolver::resolve($filePath); } /**