protected function MTimeProtectedFastFileStorage::getFullPath

Returns the full path where the file is or should be stored.

This function creates a file path that includes a unique containing directory for the file and a file name that is a hash of the virtual file name, a cryptographic secret, and the containing directory mtime. If the file is overridden by an insecure upload script, the directory mtime gets modified, invalidating the file, thus protecting against untrusted code getting executed.

Parameters

string $name: The virtual file name. Can be a relative path.

string $directory: (optional) The directory containing the file. If not passed, this is retrieved by calling getContainingDirectoryFullPath().

int $directory_mtime: (optional) The mtime of $directory. Can be passed to avoid an extra filesystem call when the mtime of the directory is already known.

Return value

string The full path where the file is or should be stored.

Overrides FileStorage::getFullPath

File

drupal/core/lib/Drupal/Component/PhpStorage/MTimeProtectedFastFileStorage.php, line 196

Definition of Drupal\Component\PhpStorage\MTimeProtectedFastFileStorage.

Class

MTimeProtectedFastFileStorage

Stores PHP code in files with securely hashed names.

Namespace

Code

protected function getFullPath($name, &$directory = NULL, &$directory_mtime = NULL) {
  if (!isset($directory)) {
    $directory = $this
      ->getContainingDirectoryFullPath($name);
  }
  if (!isset($directory_mtime)) {
    $directory_mtime = file_exists($directory) ? filemtime($directory) : 0;
  }
  return $directory . '/' . hash_hmac('sha256', $name, $this->secret . $directory_mtime) . '.php';
}