Revolution: Invalid relative media source path shows root path contents

[opengeek]

Summary

If you specify an invalid relative path for a Filesystem media source, it displays the contents of the server root folder.

Step to reproduce

Specify basePath as a non-existent relative path with the basePathRelative option set to Yes.

Observed behavior

The media source renders the contents of the root folder of the server.

Expected behavior

It should render nothing since the path is invalid and display some kind of error.

Environment

MODX 2.x (latest), nginx 1.15.0, MariaDB 10.3.7, Chrome, MacOS 10.13.6

[Jako]

Ah, I saw this lately on a foreign installation, but I did not realized, that it could be a bug.

[JoshuaLuckers]

I tried to fix this.. but I really can't figure out why it happens..

[Mark-H]

I think there's a realpath() somewhere that is evaluating to false or null because of the invalid path, resulting in it looking at the root instead.

[SnowCreative]

Yes, this has always bothered me, and my clients get confused (and can potentially do bad stuff) when the contents of the root folder show up.

[mrhaw]

Question, if we fix this now, how do I go about showing root path for my personal media sources? :)

[JoshuaLuckers]

@mrhaw that's possible by setting basePath to / and basePathRelative to no.

[mrhaw]

Sweet!! Thanks @JoshuaLuckers

[Jako]

14038 solves that somehow better. But thanks for the PR.

[Jako]

Sorry, I have accidentally closed the issue and not the PR.

[Jako]

Closing this, since #14038 is merged.