Merge pull request #7676 from nextcloud/fix-slash-in-filename

Show warning if slash is entered as filename

2 files changed, 6 insertions, 0 deletions

diff --git a/apps/dav/lib/Connector/Sabre/ExceptionLoggerPlugin.php b/apps/dav/lib/Connector/Sabre/ExceptionLoggerPlugin.php
index 68c9a1b415f..26e29e20d12 100644
--- a/apps/dav/lib/Connector/Sabre/ExceptionLoggerPlugin.php
+++ b/apps/dav/lib/Connector/Sabre/ExceptionLoggerPlugin.php
@@ -29,6 +29,7 @@ namespace OCA\DAV\Connector\Sabre;
 use OCA\DAV\Connector\Sabre\Exception\PasswordLoginForbidden;
 use OCP\Files\StorageNotAvailableException;
 use OCP\ILogger;
+use Sabre\DAV\Exception\Conflict;
 use Sabre\DAV\Exception\Forbidden;
 use Sabre\DAV\Exception\InvalidSyncToken;
 use Sabre\DAV\Exception\NotAuthenticated;
@@ -61,6 +62,9 @@ class ExceptionLoggerPlugin extends \Sabre\DAV\ServerPlugin {
 		// happens if some a client uses the wrong method for a given URL
 		// the error message itself is visible on the client side anyways
 		NotImplemented::class => true,
+		// happens when the parent directory is not present (for example when a
+		// move is done to a non-existent directory)
+		Conflict::class => true,
 	];
 
 	/** @var string */
diff --git a/apps/files/js/files.js b/apps/files/js/files.js
index 153307fec52..a1e59015b1d 100644
--- a/apps/files/js/files.js
+++ b/apps/files/js/files.js
@@ -128,6 +128,8 @@
 				throw t('files', '"{name}" is an invalid file name.', {name: name});
 			} else if (trimmedName.length === 0) {
 				throw t('files', 'File name cannot be empty.');
+			} else if (trimmedName.indexOf('/') !== -1) {
+				throw t('files', '"/" is not allowed inside a file name.');
 			} else if (OC.fileIsBlacklisted(trimmedName)) {
 				throw t('files', '"{name}" is not an allowed filetype', {name: name});
 			}