Don't disclose relative directory path for single shared files of user

The "dir" key is used within the public sharing template to indicate in which directory the user currently is when sharing a directory with subdirectories. This is needed by the JS scripts.

However, when not accessing a directory then "dir" was set to the relative path of the file (from the user's home directory), meaning that for every public shared file the sharee can see the path.
(For example if you share the file "foo.txt" from "finances/topsecret/" the sharee would still see the path "finances/topsecret/" from the shared HTML template)

This is not the excpected behaviour and can be considered a privacy problem, this patch addresses this by setting "dir" to an empty key.

diff --git a/apps/files_sharing/lib/controllers/sharecontroller.php b/apps/files_sharing/lib/controllers/sharecontroller.php
index e5fd0f401c253aa349f6df8dfb91de60fe8003c4..da0761837d84d06676dd0a73627933eeb829fbbe 100644 (file)
--- a/apps/files_sharing/lib/controllers/sharecontroller.php
+++ b/apps/files_sharing/lib/controllers/sharecontroller.php
@@ -172,7 +172,7 @@ class ShareController extends Controller {
                $shareTmpl['sharingToken'] = $token;
                $shareTmpl['server2serversharing'] = Helper::isOutgoingServer2serverShareEnabled();
                $shareTmpl['protected'] = isset($linkItem['share_with']) ? 'true' : 'false';
-               $shareTmpl['dir'] = $dir;
+               $shareTmpl['dir'] = '';
                $shareTmpl['fileSize'] = \OCP\Util::humanFileSize(\OC\Files\Filesystem::filesize($originalSharePath));
 
                // Show file list

diff --git a/apps/files_sharing/tests/controller/sharecontroller.php b/apps/files_sharing/tests/controller/sharecontroller.php
index 8dcb247556404e10cbf1c60026abfe59018bea91..f13e5b2e4974c46fb011f56479a6bebb730886c3 100644 (file)
--- a/apps/files_sharing/tests/controller/sharecontroller.php
+++ b/apps/files_sharing/tests/controller/sharecontroller.php
@@ -153,7 +153,7 @@ class ShareControllerTest extends \PHPUnit_Framework_TestCase {
                        'sharingToken' => $this->token,
                        'server2serversharing' => true,
                        'protected' => 'true',
-                       'dir' => '/',
+                       'dir' => '',
                        'downloadURL' => null,
                        'fileSize' => '33 B'
                );