diff --git a/CHANGELOG.md b/CHANGELOG.md index aa13552dbe9..6af0998b05f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## Unreleased +- Fixed an error that could occur if an invalid folder ID was passed to `craft\services\Assets::deleteFoldersByIds()`. ([#16147](https://github.com/craftcms/cms/pull/16147)) - Fixed an RCE vulnerability. ## 4.13.1.1 - 2024-11-18 diff --git a/src/services/Assets.php b/src/services/Assets.php index 0a5146aa998..a4bb7f9cfce 100644 --- a/src/services/Assets.php +++ b/src/services/Assets.php @@ -310,9 +310,13 @@ public function deleteFoldersByIds(int|array $folderIds, bool $deleteDir = true) foreach ((array)$folderIds as $folderId) { $folder = $this->getFolderById((int)$folderId); + if (!$folder) { + continue; + } + $folders[] = $folder; - if ($folder && $deleteDir) { + if ($folder->path && $deleteDir) { $volume = $folder->getVolume(); try { $volume->deleteDirectory($folder->path);