check for filename blacklist in OC_Filesystem::isValidPath

diff --git a/lib/filesystem.php b/lib/filesystem.php
index 79bce2c6d0072c27b9b72efc7703552c2222bf6a..852290e62ac3ea26b23899a83de363456ae5fb8b 100644 (file)
--- a/lib/filesystem.php
+++ b/lib/filesystem.php
@@ -403,6 +403,9 @@ class OC_Filesystem{
                if(strstr($path, '/../') || strrchr($path, '/') === '/..' ) {
                        return false;
                }
+               if(self::isFileBlacklisted($path)){
+                       return false;
+               }
                return true;
        }
 
@@ -412,20 +415,22 @@ class OC_Filesystem{
         * @param array $data from hook
         */
        static public function isBlacklisted($data) {
-               $blacklist = array('.htaccess');
                if (isset($data['path'])) {
                        $path = $data['path'];
                } else if (isset($data['newpath'])) {
                        $path = $data['newpath'];
                }
                if (isset($path)) {
-                       $filename = strtolower(basename($path));
-                       if (in_array($filename, $blacklist)) {
-                               $data['run'] = false;
-                       }
+                       $data['run'] = !self::isFileBlacklisted($path);
                }
        }
 
+       static public function isFileBlacklisted($path){
+               $blacklist = array('.htaccess');
+               $filename = strtolower(basename($path));
+               return in_array($filename, $blacklist);
+       }
+
        /**
         * following functions are equivilent to their php buildin equivilents for arguments/return values.
         */

diff --git a/tests/lib/filesystem.php b/tests/lib/filesystem.php
index 07c25e1498ac9048f4436306eeb8d73d40766991..0008336383efae0ba1be56a9112b4694d60f5b9d 100644 (file)
--- a/tests/lib/filesystem.php
+++ b/tests/lib/filesystem.php
@@ -101,6 +101,7 @@ class Test_Filesystem extends UnitTestCase {
                $rootView->mkdir('/' . $user);
                $rootView->mkdir('/' . $user . '/files');
 
+               $this->assertFalse($rootView->file_put_contents('/.htaccess', 'foo'));
                $this->assertFalse(OC_Filesystem::file_put_contents('/.htaccess', 'foo'));
                $fh = fopen(__FILE__, 'r');
                $this->assertFalse(OC_Filesystem::file_put_contents('/.htaccess', $fh));