The "dir" key is used within the public sharing template to indicate in which directo...

However, when not accessing a directory then "dir" was set to the relative path of the file (from the user's home directory), meaning that for every public shared file the sharee can see the path.
(For example if you share the file "foo.txt" from "finances/topsecret/" the sharee would still see the path "finances/topsecret/" from the shared HTML template)

This is not the excpected behaviour and can be considered a privacy problem, this patch addresses this by setting "dir" to an empty key.

Port of https://github.com/owncloud/core/pull/12262, approved with https://github.com/owncloud/core/pull/12262#issuecomment-64394040

diff --git a/apps/files_sharing/public.php b/apps/files_sharing/public.php
index 8794e4a69d497623462701570d95fa0f1790f5c1..1145b2ce2a95f315e5cb1218b15287f7acdb6a5e 100644 (file)
--- a/apps/files_sharing/public.php
+++ b/apps/files_sharing/public.php
@@ -174,7 +174,7 @@ if (isset($path)) {
                        $tmpl->assign('downloadURL',
                                OCP\Util::linkToPublic('files') . $urlLinkIdentifiers . '&download&path=' . urlencode($getPath));
                } else {
-                       $tmpl->assign('dir', $dir);
+                       $tmpl->assign('dir', '');
 
                        // Show file preview if viewer is available
                        if ($type == 'file') {