GNOME Bugzilla – Bug 720039
Symlink with relative path not followed in library
Last modified: 2021-05-19 13:59:01 UTC
It seems that a relative link is not followed in the library folder. I tried an absolute path to the same folder, restarted shotwell, and the pictures were loaded. For example, with library at `~Pictures`: 1. ~/Pictures/other_place => '../more_pics' 2. ~/Pictures/other_place => '/home/amir/more_pics' In case 1 pictures were not loaded to the folder and in case 2 they were loaded.
Hi, I'm using git-annex to backup my photos, so all my files are relative links to the git-annex storage and I confirm this is a problem. I'm using shotwell 0.20.2 Example of one of the symlinks $ ls Pictures/Photos/2014/01/01/IMG_6846.JPG -l lrwxrwxrwx 1 freyes freyes 210 Jan 1 2014 Pictures/Photos/2014/01/01/IMG_6846.JPG -> ../../../../.git/annex/objects/qz/wX/SHA256E-s3304220--6fc568b0cb0796b5b07a1ac543843dc99562f2681b0b191670d6218b81a14c6e.JPG/SHA256E-s3304220--6fc568b0cb0796b5b07a1ac543843dc99562f2681b0b191670d6218b81a14c6e.JPG Thanks,
Hi, I prepared a patch to fix this, it worked for my photo collection, but I'm not sure if it's the proper way to fix this, I would really appreciate if the maintainers could review it. Thanks,
Created attachment 292634 [details] [review] patch to let gio follow symlinks
Review of attachment 292634 [details] [review]: My concern about this approach is that it appears to be a blindly changing every instance of NOFOLLOW_SYMLINKS to NONE without considering the consequences of each situation. For example, if there's a symlink loop (i.e. ~/a/b/c where c is a symlink to a), there's no checking for that, leading to the possibility of an endless loop when recursing. (For example, see search_dir() in BatchImport). More to the point, are all these changes necessary to fix this specific bug, or are they simply being made to get rid of NOFOLLOW_SYMLINKS? It looks like the latter to me. The patch needs to address the reported problem so we can test that it solves that problem with some confidence without causing other issues elsewhere.
*** Bug 717286 has been marked as a duplicate of this bug. ***
Any news on this?
Sorry, still wading through the +1000 tickets open for shotwell, takes a bit to check every one of them
I'm testing this patch right now against 0.26.4 and it works fine. I agree there might be issues with symlink loops, but I would argue that you generally inspect directories that are trusted, unless you import files from third parties, in which case you probably have a whole other pile of security issues to worry about... But I think Nelson is right that the patch should be more limited. In my use case, I don't think import should follow symlinks, but the library access should follow symlinks.
The remark about symlink loops is a bit odd, there is code in there that checks the filesystem ids to prevent exactly that - unless I misunderstand the import code and that might not be that far fetched.
I wasn't aware of such checks. In that case, I don't have any objection to the patch.
-- GitLab Migration Automatic Message -- This bug has been migrated to GNOME's GitLab instance and has been closed from further activity. You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.gnome.org/GNOME/shotwell/-/issues/4431.