Fixes#3722
Use @microsoft.graph.downloadUrl for OneDrive file access and
fall back to the /content redirect when needed.
Reuse cached download URLs when available, and update the cache
only when a full stat entry already exists.
- refresh CSRF TTL after successful open/info/protected commands
- extend token lifetime on open requests during normal navigation
- limit CSRF protection to stable write commands
- fix callback script syntax in OAuth popup handling
- issue CSRF token on open init response
- send token via custom request header
- validate token for protected write commands
- refresh token TTL on info reload and valid protected requests
- return csrfReload marker on 403 to trigger background token refresh
- suppress duplicate CSRF refresh requests on the client
trim($this->root, '/') strips the leading slash from the root path,
making strlen() return a value 1 less than expected. This causes
substr() to include an extra character from the root folder name
in the relative path.
For example, with root folder "images":
- Expected URL: /files/image.jpg
- Actual URL: /files/s/image.jpg
Using strlen($this->root) + 1 is consistent with other URL
construction methods in elFinderVolumeLocalFileSystem (lines 206,
612, 845, 1420) which all use this correct pattern.
Fixes#3746
Sometimes uploading large files fails with the following error: Unsupported operand types: string + int {"userId":2,"exception":"[object] (TypeError(code: 0): Unsupported operand types: string + int at <path>/vendor/studio-42/elfinder/php/elFinder.php:4476).
The function file_get_contents returns a string, and PHP 8 doesn't do implicit conversion. It requires the conversion to be explicit to not give problems.
* CVE-2025-0818 (Part 1)
- Fixed arbitrary file delete by prepending the tempath to the global temp file array paths before deleting them
- This also required a new global array (elFinderAbortFiles) because the temp path could be different depeing on the configuration of elFInder.
- Removed the ability of getTempPath() to return the writableTmb path because this would unnecessarly complicate things when checking the path before deletion
* CVE-2025-0818 (Part II)
- Prevented arbitrary file read by prepending the common temp directory to the extracted onetime file path of the 'file' commands 'ontime' function.
- Prevented directory traversal and the general use of paths by using basename() for the appended file name.
- This patch currently prevents arbitrary file reads and deletes. However, it still allows this for files in the .tmp directory. This should also at least be mitigated.
Fix PHP 8 fatal error: 0 - preg_split(): Argument #2 ($subject) must be of type string, array given
Cleanup: delete unused code and replace confusing var name $raw with $info to clarify working with an array and not a string.
nao-pon