From d065b2d29edb4bb72492dde46293e77fa03b50d6 Mon Sep 17 00:00:00 2001 From: Robin Appelman Date: Sat, 9 Jun 2012 17:39:14 +0200 Subject: [PATCH] prevent opening non-music files through the media ajax api --- apps/media/ajax/api.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apps/media/ajax/api.php b/apps/media/ajax/api.php index 6e269f3bb78..a229c17e804 100644 --- a/apps/media/ajax/api.php +++ b/apps/media/ajax/api.php @@ -103,6 +103,10 @@ if($arguments['action']){ @ob_end_clean(); $ftype=OC_Filesystem::getMimeType( $arguments['path'] ); + if(substr($ftype,0,5)!='audio' and $ftype!='application/ogg'){ + echo 'Not an audio file'; + exit(); + } $songId=OC_MEDIA_COLLECTION::getSongByPath($arguments['path']); OC_MEDIA_COLLECTION::registerPlay($songId); -- 2.39.5