Coding standards
Security in ResourceSpace
Developer reference
Database
User api session functions
Geolocation functions
Storage test functions

storage_test_path()

Description

Validate a manifest path and every existing ancestor without following symlinks.
The private directory is only ever created exclusively with mode 0700.

@throws RuntimeException On changed storage, unsafe paths, symlinks or non-regular files.

Parameters

ColumnTypeDefaultDescription
$state array Server-owned recovery state.
$relative string Fixed manifest path, or empty for the private directory itself.
$state['id']
$manifest['dirs']
true

Return

string Absolute path within the current asset filestore.

Location

include/storage_test_functions.php lines 67 to 95

Definition

 
function storage_test_path(array $state, string $relative = ''): string
{
    $manifest = storage_test_manifest();
    if (
        !preg_match('/\A[a-f0-9]{32}\z/D', $state['id'])
        || $state['root'] !== storage_test_root()
        || ($relative !== '' && !isset($manifest['files'][$relative]) && !in_array($relative, $manifest['dirs'], true))
    ) {
        throw new RuntimeException('storage_test_unsafe');
    }
    $path = $state['root'] . '/.rs-storage-test-' . $state['id'];
    $parts = $relative === '' ? [] : explode('/', $relative);
    foreach (array_merge([''], $parts) as $part) {
        if ($part !== '') {
            $path .= '/' . $part;
        }
        clearstatcache(true, $path);
        if (is_link($path)) {
            throw new RuntimeException('storage_test_unsafe');
        }
        if (file_exists($path)) {
            $stat = lstat($path);
            if ($stat === false || (!is_dir($path) && (!is_file($path) || $stat['nlink'] !== 1))) {
                throw new RuntimeException('storage_test_unsafe');
            }
        }
    }
    return $path;
}

This article was last updated 13th November 2026 16:05 Europe/London time based on the source file dated 13th November 2026 11:40 Europe/London time.