prevent creating files with a / the name

diff --git a/apps/files/ajax/newfile.php b/apps/files/ajax/newfile.php
index 316eac0562d867eef695ceed954547f41cbfbb78..edb784148724e64ec0c877617f4479fc99477744 100644 (file)
--- a/apps/files/ajax/newfile.php
+++ b/apps/files/ajax/newfile.php
@@ -15,6 +15,10 @@ if($filename == '') {
        OCP\JSON::error(array("data" => array( "message" => "Empty Filename" )));
        exit();
 }
+if(strpos($filename,'/')!==false){
+       OCP\JSON::error(array("data" => array( "message" => "Invalid Filename" )));
+       exit();
+}
 
 if($source){
        if(substr($source,0,8)!='https://' and substr($source,0,7)!='http://'){

diff --git a/apps/files/ajax/newfolder.php b/apps/files/ajax/newfolder.php
index 512e0e1f6d99696dcbe288dfac2bc787ce87d48e..0668a6191f4da50be543ef91f3a5024ccb83229f 100644 (file)
--- a/apps/files/ajax/newfolder.php
+++ b/apps/files/ajax/newfolder.php
@@ -13,6 +13,10 @@ if(trim($foldername) == '') {
        OCP\JSON::error(array("data" => array( "message" => "Empty Foldername" )));
        exit();
 }
+if(strpos($filename,'/')!==false){
+       OCP\JSON::error(array("data" => array( "message" => "Invalid Foldername" )));
+       exit();
+}
 
 if(OC_Files::newFile($dir, stripslashes($foldername), 'dir')) {
        OCP\JSON::success(array("data" => array()));

diff --git a/apps/files/js/files.js b/apps/files/js/files.js
index 7cd0f388a3cb19e9f1d16c31a44a6a32b9848a65..a079deb95396eb73119320bc319caa9a1087b61f 100644 (file)
--- a/apps/files/js/files.js
+++ b/apps/files/js/files.js
@@ -452,6 +452,11 @@ $(document).ready(function() {
                input.focus();
                input.change(function(){
                        var name=$(this).val();
+                       if(name.indexOf('/')!=-1){
+                               $('#notification').text(t('files','Invalid name, \'/\' is not allowed.'));
+                               $('#notification').fadeIn();
+                               return;
+                       }
                        switch(type){
                                case 'file':
                                        $.post(