diff --git a/src/Eccube/Form/Type/Admin/ProductType.php b/src/Eccube/Form/Type/Admin/ProductType.php index 1b334af83ac..f0cb948ddbb 100644 --- a/src/Eccube/Form/Type/Admin/ProductType.php +++ b/src/Eccube/Form/Type/Admin/ProductType.php @@ -27,6 +27,10 @@ use Symfony\Component\Form\Extension\Core\Type\TextareaType; use Symfony\Component\Form\Extension\Core\Type\TextType; use Symfony\Component\Form\FormBuilderInterface; +use Symfony\Component\Form\FormError; +use Symfony\Component\Form\FormEvent; +use Symfony\Component\Form\FormEvents; +use Symfony\Component\Form\FormInterface; use Symfony\Component\OptionsResolver\OptionsResolver; use Symfony\Component\Validator\Constraints as Assert; @@ -176,6 +180,35 @@ public function buildForm(FormBuilderInterface $builder, array $options) 'mapped' => false, ]) ; + + $builder->addEventListener(FormEvents::POST_SUBMIT, function (FormEvent $event) { + /** @var FormInterface $form */ + $form = $event->getForm(); + $saveImgDir = $this->eccubeConfig['eccube_save_image_dir']; + $tempImgDir = $this->eccubeConfig['eccube_temp_image_dir']; + $this->validateFilePath($form->get('delete_images'), [$saveImgDir, $tempImgDir]); + $this->validateFilePath($form->get('add_images'), [$tempImgDir]); + }); + } + + /** + * 指定された複数ディレクトリのうち、いずれかのディレクトリ以下にファイルが存在するかを確認。 + * + * @param $form FormInterface + * @param $dirs array + */ + private function validateFilePath($form, $dirs) + { + foreach ($form->getData() as $fileName) { + $fileInDir = array_filter($dirs, function ($dir) use ($fileName) { + $filePath = realpath($dir.'/'.$fileName); + $topDirPath = realpath($dir); + return strpos($filePath, $topDirPath) === 0 && $filePath !== $topDirPath; + }); + if (!$fileInDir) { + $form->getRoot()['product_image']->addError(new FormError(trans('admin.product.image__invalid_path'))); + } + } } /** diff --git a/src/Eccube/Resource/locale/messages.en.yaml b/src/Eccube/Resource/locale/messages.en.yaml index f9baa532f37..473853e0904 100644 --- a/src/Eccube/Resource/locale/messages.en.yaml +++ b/src/Eccube/Resource/locale/messages.en.yaml @@ -608,6 +608,7 @@ admin.product.name: Product Name admin.product.image: Product Images admin.product.image__short: Images admin.product.image_size: 'More than 600px x 600px is recommended' +admin.product.image__invalid_path: Invalid image path. admin.product.sale_type: Sales Type admin.product.description_detail: Product Descriptions admin.product.description_list: Product Descriptions (All) diff --git a/src/Eccube/Resource/locale/messages.ja.yaml b/src/Eccube/Resource/locale/messages.ja.yaml index c4665fca8dd..a2f954931c2 100644 --- a/src/Eccube/Resource/locale/messages.ja.yaml +++ b/src/Eccube/Resource/locale/messages.ja.yaml @@ -608,6 +608,7 @@ admin.product.name: 商品名 admin.product.image: 商品画像 admin.product.image__short: 画像 admin.product.image_size: '推奨サイズ : 600px x 600px以上' +admin.product.image__invalid_path: 画像のパスが不正です。 admin.product.sale_type: 販売種別 admin.product.description_detail: 商品説明 admin.product.description_list: 商品説明(一覧)