laravel putFileAs path error
laravel putFileAs path error
I use the putFileAs method on the Storage facade to upload my photos.
$gallery = $request->file('feature_image');
Storage::putFileAs(
'just_for_test_putfileas', $gallery, time().'.'. $request->file('feature_image')->getClientOriginalExtension()
);
it works great and default putFileAs dir is "storage/app"
and will put my file in this direction "storage/app/just_for_test_putfileas"
when I use ../ in dir to put the file in some other direction it cause an error "whoops, it seems there is something wrong"
this block of code cause error
$gallery = $request->file('feature_image');
Storage::putFileAs(
'../just_for_test_putfileas', $gallery, time().'.'. $request->file('feature_image')->getClientOriginalExtension()
);
debug is true in env . but debug mode set off !
– movAhed
Aug 29 at 11:23
Don't use
.. in an upload feature. It smells like path traversal attack, even if there might not be one in your case.– Roland Weber
Aug 29 at 11:33
..
1 Answer
1
When you use the Storage facade without specifying a disk, it will use the default disk which is usually the local disk. This disk is rooted/jailed to the /storage/app/ directory and you cannot escape it.
Storage
local
See your settings in config/filesystem.php:
'disks' => [
'local' => [
'driver' => 'local',
'root' => storage_path('app'),
],
If you want to be able to read and write files using Laravel's filesystem functionality to a different folder, you can create a new disk and jail it to another location:
'disks' => [
'my-disk' => [
'driver' => 'local',
'root' => storage_path(),
],
In my example above I have created a new disk jailed to the /storage/ path, which is the path above /storage/app/. You can then use your disk with the Storage facade like this:
Storage
Storage::disk('my-disk')->putFileAs(...);
nicely explained +1
– Sohel0415
Aug 29 at 11:21
By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.
see the stackTrace of error, enable your debug first
– Sohel0415
Aug 29 at 11:15