sascha
/
nextcloud-server
mirror of https://github.com/nextcloud/server.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

verify that paths are valid for recursive local move 

Signed-off-by: Robin Appelman <robin@icewind.nl>
pull/16129/head
Robin Appelman 2019-06-27 11:10:08 +07:00 committed by Backportbot
parent ac486b003b
commit cdc97ec9c3
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
lib/private/Files/Storage/Local.php
Unescape Escape View File

@ -39,6 +39,7 @@
namespace OC\Files\Storage;
use OC\Files\Filesystem;
use OC\Files\Storage\Wrapper\Jail;
use OCP\Files\ForbiddenException;
use OCP\Files\Storage\IStorage;
@ -231,6 +232,18 @@ class Local extends \OC\Files\Storage\Common {
}
private function treeContainsBlacklistedFile(string $path): bool {
$iterator = new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($path));
foreach ($iterator as $file) {
/** @var \SplFileInfo $file */
if (Filesystem::isFileBlacklisted($file->getBasename())) {
return true;
}
}
return false;
}
public function rename($path1, $path2) {
$srcParent = dirname($path1);
$dstParent = dirname($path2);
@ -267,6 +280,10 @@ class Local extends \OC\Files\Storage\Common {
}
return $result;
}
if ($this->treeContainsBlacklistedFile($this->getSourcePath($path1))) {
throw new ForbiddenException('Invalid path', false);
}
}
return rename($this->getSourcePath($path1), $this->getSourcePath($path2));
@ -362,6 +379,10 @@ class Local extends \OC\Files\Storage\Common {
* @throws ForbiddenException
*/
public function getSourcePath($path) {
if (Filesystem::isFileBlacklisted($path)) {
throw new ForbiddenException('Invalid path', false);
}
$fullPath = $this->datadir . $path;
$currentPath = $path;
if ($this->allowSymlinks || $currentPath === '') {