fix(scope): judge a linked path by its target as well

src/Support/ImageScope.php

@@ -159,11 +159,13 @@ public function canRead(?string $relative): bool
             return true;
         }
 
-        return FileManagerAccess::isAccessible(
-            $relative,
-            $this->groupIds,
-            $this->restrictionsFor($relative)
-        );
+        foreach ($this->namesOf($relative) as $name) {
+            if (!FileManagerAccess::isAccessible($name, $this->groupIds, $this->restrictionsFor($name))) {
+                return false;
+            }
+        }
+
+        return true;
     }
 
     /**
@@ -187,11 +189,44 @@ public function canWrite(?string $relative): bool
             return true;
         }
 
-        return FileManagerAccess::canModifyExistingPath(
-            $relative,
-            $this->groupIds,
-            $this->restrictionsFor($relative)
-        );
+        foreach ($this->namesOf($relative) as $name) {
+            if (!FileManagerAccess::canModifyExistingPath($name, $this->groupIds, $this->restrictionsFor($name))) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /**
+     * A path, and where it really is when a link leads there.
+     *
+     * `file_groups` rows are keyed by name, so a link is a second name for a
+     * file that keeps the restrictions of the first. A path that does not exist
+     * yet is judged by its nearest existing ancestor.
+     *
+     * @return list<string>
+     */
+    private function namesOf(?string $relative): array
+    {
+        $relative = FileManagerAccess::normalizeRelativePath($relative);
+        $path = $this->root . '/' . $relative;
+        $missing = '';
+
+        while (($real = realpath($path)) === false) {
+            $parent = dirname($path);
+
+            if ($parent === $path) {
+                return [$relative];
+            }
+
+            $missing = '/' . basename($path) . $missing;
+            $path = $parent;
+        }
+
+        $target = $this->relativeOf(str_replace('\\', '/', $real) . $missing);
+
+        return $target === null || $target === $relative ? [$relative] : [$relative, $target];
     }
 
     /**

tests/Unit/ImageScopeTest.php

@@ -803,3 +803,44 @@ function aimageSiteWideRoots(): void
     expect($styles)->toContain('[hidden] { display: none !important; }')
         ->and($script)->toContain('.hidden = true');
 });
+
+// ---------------------------------------------------------------------------
+// Links
+// ---------------------------------------------------------------------------
+
+/** `images/public/alias` leading to `images/private`, or null where links cannot be made. */
+function aimageLinkedPrivateFolder(): ?string
+{
+    aimagePutImage('images/private/secret.png');
+    aimagePutImage('images/public/open.png');
+    $link = AIMAGE_TEST_ROOT . '/assets/images/public/alias';
+
+    return @symlink(AIMAGE_TEST_ROOT . '/assets/images/private', $link) ? $link : null;
+}
+
+test('a link does not open what its target keeps closed', function () {
+    aimageUser(7, 3, [4]);
+    aimageSetFileRoot('assets');
+    aimageRestrict('images/private', 9);
+    $link = aimageLinkedPrivateFolder() ?? $this->markTestSkipped('This system cannot create links.');
+
+    $scope = ImageScope::forUser(7);
+
+    expect($scope->canRead('images/public/alias/secret.png'))->toBeFalse()
+        ->and($scope->read('images/public/alias/secret.png'))->toBeNull()
+        ->and($scope->canWrite('images/public/alias/new.png'))->toBeFalse()
+        ->and(array_column($scope->listImages('images/public', true), 'path'))->toBe(['images/public/open.png']);
+
+    unlink($link);
+});
+
+test('a link opens to whoever may see its target', function () {
+    aimageUser(7, 3, [9]);
+    aimageSetFileRoot('assets');
+    aimageRestrict('images/private', 9);
+    $link = aimageLinkedPrivateFolder() ?? $this->markTestSkipped('This system cannot create links.');
+
+    expect(ImageScope::forUser(7)->canRead('images/public/alias/secret.png'))->toBeTrue();
+
+    unlink($link);
+});