Merge pull request #15336 from owncloud/revive-15215

Properly quote file names in listFiles query for GDrive

2 files changed, 20 insertions, 18 deletions

diff --git a/apps/files_external/lib/google.php b/apps/files_external/lib/google.php
index 291f9364ddd..541113fb530 100644
--- a/apps/files_external/lib/google.php
+++ b/apps/files_external/lib/google.php
@@ -113,7 +113,7 @@ class Google extends \OC\Files\Storage\Common {
 				if (isset($this->driveFiles[$path])) {
 					$parentId = $this->driveFiles[$path]->getId();
 				} else {
-					$q = "title='".$name."' and '".$parentId."' in parents and trashed = false";
+					$q = "title='" . str_replace("'","\\'", $name) . "' and '" . str_replace("'","\\'", $parentId) . "' in parents and trashed = false";
 					$result = $this->service->files->listFiles(array('q' => $q))->getItems();
 					if (!empty($result)) {
 						// Google Drive allows files with the same name, ownCloud doesn't
@@ -257,7 +257,7 @@ class Google extends \OC\Files\Storage\Common {
 				if ($pageToken !== true) {
 					$params['pageToken'] = $pageToken;
 				}
-				$params['q'] = "'".$folder->getId()."' in parents and trashed = false";
+				$params['q'] = "'" . str_replace("'","\\'", $folder->getId()) . "' in parents and trashed = false";
 				$children = $this->service->files->listFiles($params);
 				foreach ($children->getItems() as $child) {
 					$name = $child->getTitle();
diff --git a/tests/lib/files/storage/storage.php b/tests/lib/files/storage/storage.php
index 30f403d60df..ad7522f1ea8 100644
--- a/tests/lib/files/storage/storage.php
+++ b/tests/lib/files/storage/storage.php
@@ -104,13 +104,14 @@ abstract class Storage extends \Test\TestCase {
 	}
 
 	public function directoryProvider() {
-		return array(
-			array('folder'),
-			array(' folder'),
-			array('folder '),
-			array('folder with space'),
-			array('spéciäl földer'),
-		);
+		return [
+			['folder'],
+			[' folder'],
+			['folder '],
+			['folder with space'],
+			['spéciäl földer'],
+			['test single\'quote'],
+		];
 	}
 
 	function loremFileProvider() {
@@ -163,15 +164,16 @@ abstract class Storage extends \Test\TestCase {
 
 
 	public function copyAndMoveProvider() {
-		return array(
-			array('/source.txt', '/target.txt'),
-			array('/source.txt', '/target with space.txt'),
-			array('/source with space.txt', '/target.txt'),
-			array('/source with space.txt', '/target with space.txt'),
-			array('/source.txt', '/tärgét.txt'),
-			array('/sòurcē.txt', '/target.txt'),
-			array('/sòurcē.txt', '/tärgét.txt'),
-		);
+		return [
+			['/source.txt', '/target.txt'],
+			['/source.txt', '/target with space.txt'],
+			['/source with space.txt', '/target.txt'],
+			['/source with space.txt', '/target with space.txt'],
+			['/source.txt', '/tärgét.txt'],
+			['/sòurcē.txt', '/target.txt'],
+			['/sòurcē.txt', '/tärgét.txt'],
+			['/single \' quote.txt', '/tar\'get.txt'],
+		];
 	}
 
 	public function initSourceAndTarget ($source, $target = null) {