Skip to content

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• Pricing

• Notifications

• Fork 1.3k

• Code

• Issues 604

• Pull requests 55

• Discussions

• Actions

• Security

• Insights

Permalink

Browse files

Browse the repository at this point in the history

[Security] Admin Authenticated Arbitrary File Read (#14974)

* Fix: disable asset importFromServer for users

* Doc: Add Upgrade Notes

• Loading branch information

Showing 3 changed files with 9 additions and 1 deletion.

• • • AssetController.php
  • • tree.js
• • README.md

4 changes: 4 additions & 0 deletions bundles/AdminBundle/Controller/Admin/Asset/AssetController.php

Expand Up

@@ -2459,6 +2459,10 @@ public function importServerAction(Request $request)

*/

public function importServerFilesAction(Request $request)

{

if(!Tool\Admin::getCurrentUser()->isAdmin()) {

throw $this->createAccessDeniedException(‘Permission denied. You don\’t have the rights to import files from the server!’);

}

$assetFolder = Asset::getById((int) $request->get(‘parentId’));

if (!$assetFolder) {

throw $this->createNotFoundException(‘Parent asset not found’);

Expand Down

2 changes: 1 addition & 1 deletion bundles/AdminBundle/Resources/public/js/pimcore/asset/tree.js

Expand Up

@@ -594,7 +594,7 @@ pimcore.asset.tree = Class.create({

});

}

if (perspectiveCfg.inTreeContextMenu(“asset.add.importFromServer”)) {

if (perspectiveCfg.inTreeContextMenu(“asset.add.importFromServer”) && pimcore.currentuser.admin) {

menuItems.push({

text: t(“import_from_server”),

handler: this.importFromServer.bind(this, tree, record),

Expand Down

@@ -1,8 +1,12 @@

Upgrade Notes

10.5.21

- [Assets] The Asset `Import from Server` feature is now only available for admins. It will be removed in Pimcore 11

10.5.13

- [Web2Print] Print document twig expressions are now executed in a sandbox with restrictive security policies (just like Sending mails and Dataobject Text Layouts introduced in 10.5.9).

10.5.10

- [DataObject] Deprecated: Loading non-Concrete objects with the Concrete class will not be possible in Pimcore 11.

Expand Down

0 comments on commit 498cade

Please sign in to comment.