]> source.dussan.org Git - nextcloud-server.git/commit
Don't disclose relative directory path for single shared files of user
authorLukas Reschke <lukas@owncloud.com>
Tue, 18 Nov 2014 13:54:08 +0000 (14:54 +0100)
committerMorris Jobke <hey@morrisjobke.de>
Tue, 18 Nov 2014 17:51:57 +0000 (18:51 +0100)
commitf3ab4f3faf9c6f07c14cba406188d56a1e81b676
tree93749ed4dc09064439c3860eb04419a6944647bf
parent5f07fb15dccb40339c326c0294f4d73a1d6e77b6
Don't disclose relative directory path for single shared files of user

The "dir" key is used within the public sharing template to indicate in which directory the user currently is when sharing a directory with subdirectories. This is needed by the JS scripts.

However, when not accessing a directory then "dir" was set to the relative path of the file (from the user's home directory), meaning that for every public shared file the sharee can see the path.
(For example if you share the file "foo.txt" from "finances/topsecret/" the sharee would still see the path "finances/topsecret/" from the shared HTML template)

This is not the excpected behaviour and can be considered a privacy problem, this patch addresses this by setting "dir" to an empty key.
apps/files_sharing/lib/controllers/sharecontroller.php
apps/files_sharing/tests/controller/sharecontroller.php