Remove invalid characters from app id to prevent loading of invalid resources

diff --git a/core/ajax/translations.php b/core/ajax/translations.php
index e22cbad4708f09979e41273c6eef1bbda2d4f5ba..e52a2e9b1e8292b8d90295b77858ddc465c9261f 100644 (file)
--- a/core/ajax/translations.php
+++ b/core/ajax/translations.php
@@ -22,6 +22,7 @@
 */
 
 $app = $_POST["app"];
+$app = OC_App::cleanAppId($app);
 
 $l = OC_L10N::get( $app );
 

diff --git a/lib/app.php b/lib/app.php
index 3a4e21e8cd1e9f49730f79ef549be77d05ddbded..54f16d6bdcd125f03193c552d8b82d611f5cd7d3 100644 (file)
--- a/lib/app.php
+++ b/lib/app.php
@@ -38,6 +38,15 @@ class OC_App{
        static private $checkedApps = array();
        static private $altLogin = array();
 
+       /**
+        * @brief clean the appid
+        * @param $app Appid that needs to be cleaned
+        * @return string
+        */
+       public static function cleanAppId($app) {
+               return str_replace(array('\0', '/', '\\', '..'), '', $app);
+       }
+
        /**
         * @brief loads all apps
         * @param array $types

diff --git a/lib/base.php b/lib/base.php
index 5bfdb0b7c0a568f893d864b3e31c51f0a0580733..b9e59c3431ea043077f1a6466eaece9176d1839a 100644 (file)
--- a/lib/base.php
+++ b/lib/base.php
@@ -468,7 +468,7 @@ class OC {
                register_shutdown_function(array('OC_Helper', 'cleanTmp'));
 
                //parse the given parameters
-               self::$REQUESTEDAPP = (isset($_GET['app']) && trim($_GET['app']) != '' && !is_null($_GET['app']) ? str_replace(array('\0', '/', '\\', '..'), '', strip_tags($_GET['app'])) : OC_Config::getValue('defaultapp', 'files'));
+               self::$REQUESTEDAPP = (isset($_GET['app']) && trim($_GET['app']) != '' && !is_null($_GET['app']) ? OC_App::cleanAppId(strip_tags($_GET['app'])) : OC_Config::getValue('defaultapp', 'files'));
                if (substr_count(self::$REQUESTEDAPP, '?') != 0) {
                        $app = substr(self::$REQUESTEDAPP, 0, strpos(self::$REQUESTEDAPP, '?'));
                        $param = substr($_GET['app'], strpos($_GET['app'], '?') + 1);

diff --git a/lib/l10n.php b/lib/l10n.php
index ee8790092655d40dc3b2acc3fde8172e6bd73b78..e272bcd79f3e7e1c81558fb1b4ad2d47830586fe 100644 (file)
--- a/lib/l10n.php
+++ b/lib/l10n.php
@@ -97,7 +97,7 @@ class OC_L10N{
                if ($this->app === true) {
                        return;
                }
-               $app = $this->app;
+               $app = OC_App::cleanAppId($this->app);
                $lang = $this->lang;
                $this->app = true;
                // Find the right language

diff --git a/settings/ajax/disableapp.php b/settings/ajax/disableapp.php
index e89de928eac13c3e9278279daf402fe1f470d9b6..466a719157d6fd726d185df6d69d57c975f6c6e9 100644 (file)
--- a/settings/ajax/disableapp.php
+++ b/settings/ajax/disableapp.php
@@ -2,6 +2,6 @@
 OC_JSON::checkAdminUser();
 OCP\JSON::callCheck();
 
-OC_App::disable($_POST['appid']);
+OC_App::disable(OC_App::cleanAppId($_POST['appid']));
 
 OC_JSON::success();

diff --git a/settings/ajax/enableapp.php b/settings/ajax/enableapp.php
index 18202dc39e9ceca8ae200cb78e7538c3ce4490ca..ab84aee516653c0fc14cf1e7ce538caae9b2723c 100644 (file)
--- a/settings/ajax/enableapp.php
+++ b/settings/ajax/enableapp.php
@@ -3,7 +3,7 @@
 OC_JSON::checkAdminUser();
 OCP\JSON::callCheck();
 
-$appid = OC_App::enable($_POST['appid']);
+$appid = OC_App::enable(OC_App::cleanAppId($_POST['appid']));
 if($appid !== false) {
        OC_JSON::success(array('data' => array('appid' => $appid)));
 } else {

diff --git a/settings/ajax/navigationdetect.php b/settings/ajax/navigationdetect.php
index 93acb50dc200adffd78285b94fc46c4d084839be..607c0e873f9dcff5acc2de16781850b42049cf98 100644 (file)
--- a/settings/ajax/navigationdetect.php
+++ b/settings/ajax/navigationdetect.php
@@ -4,6 +4,7 @@ OC_Util::checkAdminUser();
 OCP\JSON::callCheck();
 
 $app = $_GET['app'];
+$app = OC_App::cleanAppId($app);
 
 //load the one app and see what it adds to the navigation
 OC_App::loadApp($app);

diff --git a/settings/ajax/updateapp.php b/settings/ajax/updateapp.php
index 77c0bbc3e36cc3af4f266068c8ee405e87af004c..9367a3b5a3bf9e76645583fc53b7b9967e470233 100644 (file)
--- a/settings/ajax/updateapp.php
+++ b/settings/ajax/updateapp.php
@@ -4,6 +4,7 @@ OC_JSON::checkAdminUser();
 OCP\JSON::callCheck();
 
 $appid = $_POST['appid'];
+$appid = OC_App::cleanAppId($appid);
 
 $result = OC_Installer::updateApp($appid);
 if($result !== false) {