forkcms/forkcms — pull request #560 by dubgeiser (2013-09-10 12:32:26+00:00)
Title: Safer file removal.

When the Symfony FileSystem component was introduced, a slight caveat
was overseen; when FileSystem#remove() receives a directory, it will
remove that directory... probably for convenience reasons.

The issue with this is that sometimes we concatenate whole paths and the
delete them... SpoonFile::delete() would silently not delete anything if
the file was not found, but FileSystem does not behave in the same way;
take the blog edit action in the backend for instance, due to flawed
logic, following code would delete the whole blog/source directory:

if($this->frm->getField('image')->isFilled())
{
$fs->remove($imagePath . '/source/' . $this->record['image']);
// ...
}

In case we have added an article without an image, and then later on, we
upload an image => $this->record['image'] will be empty causing the
whole source/ directory to be emptied... which is _not_ what we want.

I have placed checks (is_file($filename)) all over where I deemed
necessary to more adhere to the previous behaviour of
SpoonFile::delete() so that this will not happen in the base
distribution of fork.