FEAT #7621 trim /

modules/content_management/class/class_content_manager_tools_Abstract.php

@@ -599,7 +599,8 @@ abstract class content_management_tools_Abstract
         $_SESSION['cm_applet'][$_SESSION['user']['UserId']] = [];
         $_SESSION['cm_applet'][$_SESSION['user']['UserId']][$uid_applet_name]=$uid_applet_name.'.lck';
 
-        $file = "{$jar_url}rest/jnlp?fileName={$jnlp_name}";
+        $pathUrl = trim($jar_url, '/');
+        $file = "{$pathUrl}/rest/jnlp?fileName={$jnlp_name}";
 
         //echo '<a id="jnlp_file" href="'.$file.'" onclick="window.location.href=\''.$file.'\';self.close();"></a>';
         echo '<script>window.location.href=\''.$file.'\';if($(\'CMApplet\')) {destroyModal(\'CMApplet\');};if($(\'CMApplet\')) {destroyModal(\'CMApplet\');};</script>';

src/core/controllers/CoreController.php

@@ -77,7 +77,7 @@ class CoreController
 
         if (explode('.', $data['fileName'])[1] != 'jnlp') {
             return $response->withStatus(403)->withJson(['errors' => 'File extension forbidden']);
-        } elseif (strpos($data['fileName'], "{$GLOBALS['userId']}_maarchCM_")) {
+        } elseif (strpos($data['fileName'], "{$GLOBALS['userId']}_maarchCM_") === false) {
             return $response->withStatus(403)->withJson(['errors' => 'File name forbidden']);
         }