Removing magic file handling from responses

[ndm2]

This is a (multiple allowed):

• bug

• enhancement

• feature-discussion (RFC)

• CakePHP Version: 4.0.0

I've seen this over and over again, people try to send files and accidentally pass non-absolute paths (filenames only, relative paths, ...) to Response::file()/withFile(), thus having CakePHP do it's "magic", trying to look up the file in APP, which by default is the src folder.

Even if auto-resolving non-absolute paths would be deemed useful, who would actually want to serve files from the src folder? I would like to suggest to remove this behavior in 4.0, completely that is, ie. make withFile() require an absolute path, and fail hard for anything else.

Even though the current behavior is documented in the API docs, it's IMHO an unnecessary boobytrap, and people seem to step in to it all the time.

[saeideng]

which by default is the src folder.

yes, cake uses APP constant

cakephp/src/Http/Response.php

Lines 2397 to 2414 in 40ec1f4

	protected function validateFile($path)
	{
	if (strpos($path, '../') !== false || strpos($path, '..\\') !== false) {
	throw new NotFoundException(__d('cake', 'The requested file contains `..` and will not be read.'));
	}
	if (!is_file($path)) {
	$path = APP . $path;
	}
	$file = new File($path);
	if (!$file->exists() || !$file->readable()) {
	if (Configure::read('debug')) {
	throw new NotFoundException(sprintf('The requested file %s was not found or not readable', $path));
	}
	throw new NotFoundException(__d('cake', 'The requested file was not found'));
	}
	return $file;

[ADmad]

make withFile() require an absolute path, and fail hard for anything else.

👍

[markstory]

We should add a deprecation warning for this scenario now.

[markstory]

Closing as the deprecation has been added.