diff options
| author | Ferdinand Thiessen <opensource@fthiessen.de> | 2024-02-03 11:32:51 +0100 |
|---|---|---|
| committer | Ferdinand Thiessen <opensource@fthiessen.de> | 2024-02-03 11:32:51 +0100 |
| commit | 2c8aee8f99c20a8ff7b8fdcdaf152aa86b549540 (patch) | |
| tree | e63005e34cfc3811c5be37c060d60e0da50d00ae | |
| parent | 05a03dd663472fee3f4644cdb6a2d11c09703631 (diff) | |
| download | nextcloud-server-2c8aee8f99c20a8ff7b8fdcdaf152aa86b549540.tar.gz nextcloud-server-2c8aee8f99c20a8ff7b8fdcdaf152aa86b549540.zip | |
fix(ContactsStore): Sanitize user ID given to guest avatar route
It is not allowed to use slashes within path parameters, so they would need to be encoded.
But URL encoded slashes are not suported by Apache, so instead replace slash with space.
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
| -rw-r--r-- | lib/private/Contacts/ContactsMenu/ContactsStore.php | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/private/Contacts/ContactsMenu/ContactsStore.php b/lib/private/Contacts/ContactsMenu/ContactsStore.php index 1b3ef55cf20..2f141cbc0ab 100644 --- a/lib/private/Contacts/ContactsMenu/ContactsStore.php +++ b/lib/private/Contacts/ContactsMenu/ContactsStore.php @@ -353,9 +353,9 @@ class ContactsStore implements IContactsStore { $avatar = $this->urlGenerator->linkToRouteAbsolute('core.avatar.getAvatar', ['userId' => $uid, 'size' => 64]); $entry->setProperty('isUser', true); } elseif (!empty($contact['FN'])) { - $avatar = $this->urlGenerator->linkToRouteAbsolute('core.GuestAvatar.getAvatar', ['guestName' => $contact['FN'], 'size' => 64]); + $avatar = $this->urlGenerator->linkToRouteAbsolute('core.GuestAvatar.getAvatar', ['guestName' => str_replace('/', ' ', $contact['FN']), 'size' => 64]); } else { - $avatar = $this->urlGenerator->linkToRouteAbsolute('core.GuestAvatar.getAvatar', ['guestName' => $uid, 'size' => 64]); + $avatar = $this->urlGenerator->linkToRouteAbsolute('core.GuestAvatar.getAvatar', ['guestName' => str_replace('/', ' ', $uid), 'size' => 64]); } $entry->setAvatar($avatar); } |