diff options
| author | Matthew Dawson <matthew@mjdsystems.ca> | 2011-01-03 17:46:18 -0500 |
|---|---|---|
| committer | Matthew Dawson <matthew@mjdsystems.ca> | 2011-01-03 17:48:31 -0500 |
| commit | 61ce6e21ec751269501302b91d1d2e60b6cea2e9 (patch) | |
| tree | a7cf6119947abe70d7c1a5a23bb29a817552882c | |
| parent | 290b2d7355ed7075eb1e05f6d4b36d3ea1b9534b (diff) | |
| download | nextcloud-server-61ce6e21ec751269501302b91d1d2e60b6cea2e9.tar.gz nextcloud-server-61ce6e21ec751269501302b91d1d2e60b6cea2e9.zip | |
Fix a chroot issue where the path /.. (and related paths) are not caught and removed.
Signed-off-by: Matthew Dawson <matthew@mjdsystems.ca>
| -rw-r--r-- | inc/lib_filesystem.php | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/inc/lib_filesystem.php b/inc/lib_filesystem.php index a64d2ba599b..accc133b7b6 100644 --- a/inc/lib_filesystem.php +++ b/inc/lib_filesystem.php @@ -111,7 +111,7 @@ class OC_FILESYSTEM{ if(substr($path,0,1)!=='/'){ $path='/'.$path; } - if(strstr($path,'/../')){ + if(strstr($path,'/../') || strrchr($path, '/') === '/..' ){ return false; } return true;//dummy untill premissions are correctly implemented, also the correcty value because for now users are locked in their seperate data dir and can read/write everything in there |