sascha
/
nextcloud-server
mirror of https://github.com/nextcloud/server.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #45014 from nextcloud/forbid-moving-subfolder 

fix: forbid moving a folder into a subfolder of itself
pull/45524/head
Robin Appelman 2024-05-27 14:29:34 +07:00 committed by GitHub
parent b8aef38a0d 66d36bffa6
commit d87c23242b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/private/Files/View.php
Unescape Escape View File

@ -20,6 +20,7 @@ use OCP\Files\Cache\ICacheEntry;
use OCP\Files\ConnectionLostException;
use OCP\Files\EmptyFileNameException;
use OCP\Files\FileNameTooLongException;
use OCP\Files\ForbiddenException;
use OCP\Files\InvalidCharacterInPathException;
use OCP\Files\InvalidDirectoryException;
use OCP\Files\InvalidPathException;
@ -694,6 +695,11 @@ class View {
public function rename($source, $target) {
$absolutePath1 = Filesystem::normalizePath($this->getAbsolutePath($source));
$absolutePath2 = Filesystem::normalizePath($this->getAbsolutePath($target));
if (str_starts_with($absolutePath2, $absolutePath1 . '/')) {
throw new ForbiddenException("Moving a folder into a child folder is forbidden", false);
}
$targetParts = explode('/', $absolutePath2);
$targetUser = $targetParts[1] ?? null;
$result = false;