public MTimeProtectedFastFileStorage::getFullPath($name, &$directory = NULL, &$directory_mtime = NULL)
Gets the full path where the file is or should be stored.
This function creates a file path that includes a unique containing directory for the file and a file name that is a hash of the virtual file name, a cryptographic secret, and the containing directory mtime. If the file is overridden by an insecure upload script, the directory mtime gets modified, invalidating the file, thus protecting against untrusted code getting executed.
string $name: The virtual file name. Can be a relative path.
string $directory: (optional) The directory containing the file. If not passed, this is retrieved by calling getContainingDirectoryFullPath().
int $directory_mtime: (optional) The mtime of $directory. Can be passed to avoid an extra filesystem call when the mtime of the directory is already known.
string The full path where the file is or should be stored.
Overrides FileStorage::getFullPath
public function getFullPath($name, &$directory = NULL, &$directory_mtime = NULL) { if (!isset($directory)) { $directory = $this->getContainingDirectoryFullPath($name); } if (!isset($directory_mtime)) { $directory_mtime = file_exists($directory) ? filemtime($directory) : 0; } return $directory . '/' . hash_hmac('sha256', $name, $this->secret . $directory_mtime) . '.php'; }
© 2001–2016 by the original authors
Licensed under the GNU General Public License, version 2 and later.
Drupal is a registered trademark of Dries Buytaert.
https://api.drupal.org/api/drupal/core!lib!Drupal!Component!PhpStorage!MTimeProtectedFastFileStorage.php/function/MTimeProtectedFastFileStorage::getFullPath/8.1.x