c.Attachment returns 404 error when file is in outside folder

[efkz]

Hi all!

Trying to serve a file as an attachment. When file is located in the same folder as program - all ok.
But when I try to serve file that is located in a folder above program's folder - I get 404 error.
I still can read file contents.

Is it a bug or I missing something?

[efkz]

Please help!

Echo v 3 behaves ok, but v fails

[aldas]

Try using absolute paths. file.Open etc do not work ok with relative paths. If I recall correctly Go changed this due security implications.

[efkz]

absolute path also fails
used crutches - a symbolic link

[navaneeth-dev]

absolute path does not work, pls help. I dont want to use symlink

[aldas]

@navaneeth-dev You need to check/debug what the returned error is. It may be that your process may not have permissions to open that file etc. Also - these things depend on the operating system.

This is small working (under Ubuntu) example for opening absolute path.

func main() {
	e := echo.New()
	e.Use(middleware.Logger())

	e.GET("/", func(c echo.Context) error {
		return c.Attachment("/etc/hosts", "xxx")
	})

	if err := e.Start(":8080"); err != nil && !errors.Is(err, http.ErrServerClosed) {
		log.Fatal(err)
	}
}

[navaneeth-dev]

Ok this works but not in pocketbase. I will check in that project

[nietaki]

FWIW I had a similar issue in v5 and it seems related to how the c.echo.Filesystem works.

A quick and very dirty (would break lots of things in a real project) fix was to change the Filesystem in the Config and make sure the paths passed to c.Inline work with it:

	config := echo.Config{
		Filesystem: os.DirFS("/"),
	}
	e := echo.NewWithConfig(config)
// ...

	e.GET("/", func(c *echo.Context) error {
		filename := getSomeFilename()

		filename = strings.TrimPrefix(filename, "/")
		return c.Inline(filename, base)
	})

Trimming the leading slashes was needed for the paths to work with the os.DirFS()

[aldas]

Note:
In v5 the default filesystem is limited to application current working dir (CWD).

Filesystem field is still public, so you do not need to use echo.NewWithConfig(echo.Config{ ... }) way. This still works:

	e := echo.New()
	e.Filesystem = os.DirFS("/")  // using root is not advisable. try to limit it.