myron/novacpx
1
0
Fork 0
mirror of https://github.com/myronblair/novacpx synced 2026-07-28 13:14:33 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix: File Manager upload never read target path from multipart POST/query string

Browse Source 
upload only checked [path], which is parsed from JSON php://input and is always empty for multipart/form-data uploads. It silently fell back to a hardcoded /public_html, which does not exist at filesystem root - breaking uploads for the admin File Manager (baseDir=/) entirely, though it went unnoticed for regular hosting accounts since /public_html happens to be their real default. Now falls back through  and  as well.
This commit is contained in:
NovaCPX Admin
2026-07-15 14:19:44 -05:00
parent bc691466cd
commit d6321c3268
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
panel/api/endpoints/files.php
+1 -1
View File
@@ -220,7 +220,7 @@ match ($action) {
})(),
'upload' => (function() use ($baseDir, $body) {
$dir = safe_path($baseDir, $body['path'] ?? '/public_html');
$dir = safe_path($baseDir, $body['path'] ?? $_POST['path'] ?? $_GET['path'] ?? '/public_html');
require_dangerous_confirm($baseDir, $dir, $body);
if (!is_dir($dir)) Response::error("Target directory not found");
if (!is_writable($dir)) Response::error("Permission denied writing to this directory");