id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc	mlocked
11925	Symlinks to external files no longer served by mythbackend	pmhahn@…	dblain	"Packaging MythTV for Debian requires to re-use the already packaged JavaScript libraries jquery/prototype/scriptaculous as provided by Debian in /usr/share/javascript/. With Apache they're made available via http://.../javascript/..., but since MythTV has it's own http server implementation at TCP port 6544, I tried to put links into /usr/share/mythtv/html/js/ to /usr/share/javascript/, which were not served by MythTV.

The original implementation (28c30ecf 2011-03-09) used QDir.makeAbsolute() to resolve relative path into absolute paths, which does not resolve symbolic links. Because of that the original code contains an explicit call to isSymlink() and symLinkTarget().

Later on (381c2ebf 2012-07-13) the code was changed to use canonicalPath() and canonicalFilePath() to resolve ""../""s and symlinks in the path, which 
1. renders the explicit code to handle symlinks obsolete,
2. breaks the case were the symlink deliberately points outside MytvTVs http server directory.

The attached path implements a compromise, where only the directory is required to to be inside MythTVs web directory, but links can point outside it."	Patch - Bug Fix	closed	minor	0.27.1	MythTV - UPnP	0.27-fixes	medium	Won't Fix	symlink Debian		0