diff options
| author | Bjoern Schiessle <schiessle@owncloud.com> | 2014-07-24 18:12:08 +0200 |
|---|---|---|
| committer | Bjoern Schiessle <schiessle@owncloud.com> | 2014-07-25 10:21:18 +0200 |
| commit | 06bcf3db8d5d16ff70835fef7139b9446270cb24 (patch) | |
| tree | d1f964e2d9e9f067d42731c240fa495620abbd0d | |
| parent | d6e61745c88c63590fa849ce77bc42ab66c71814 (diff) | |
| download | nextcloud-server-06bcf3db8d5d16ff70835fef7139b9446270cb24.tar.gz nextcloud-server-06bcf3db8d5d16ff70835fef7139b9446270cb24.zip | |
fix sharing update, add proper escaping
| -rw-r--r-- | apps/files_sharing/appinfo/update.php | 6 | ||||
| -rw-r--r-- | apps/files_sharing/tests/update.php | 1 |
2 files changed, 5 insertions, 2 deletions
diff --git a/apps/files_sharing/appinfo/update.php b/apps/files_sharing/appinfo/update.php index fc547ba349d..72acdbac736 100644 --- a/apps/files_sharing/appinfo/update.php +++ b/apps/files_sharing/appinfo/update.php @@ -32,6 +32,7 @@ function updateFilePermissions($chunkSize = 99) { } } + $connection = \OC_DB::getConnection(); $chunkedPermissionList = array_chunk($updatedRows, $chunkSize, true); foreach ($chunkedPermissionList as $subList) { @@ -39,7 +40,7 @@ function updateFilePermissions($chunkSize = 99) { //update share table $ids = implode(',', array_keys($subList)); foreach ($subList as $id => $permission) { - $statement .= "WHEN " . $id . " THEN " . $permission . " "; + $statement .= "WHEN " . $connection->quote($id, \PDO::PARAM_INT) . " THEN " . $permission . " "; } $statement .= ' END WHERE `id` IN (' . $ids . ')'; @@ -95,6 +96,7 @@ function removeSharedFolder($mkdirs = true, $chunkSize = 99) { } $chunkedShareList = array_chunk($shares, $chunkSize, true); + $connection = \OC_DB::getConnection(); foreach ($chunkedShareList as $subList) { @@ -102,7 +104,7 @@ function removeSharedFolder($mkdirs = true, $chunkSize = 99) { //update share table $ids = implode(',', array_keys($subList)); foreach ($subList as $id => $target) { - $statement .= "WHEN " . $id . " THEN '/Shared" . $target . "' "; + $statement .= "WHEN " . $connection->quote($id, \PDO::PARAM_INT) . " THEN " . $connection->quote('/Shared' . $target, \PDO::PARAM_STR); } $statement .= ' END WHERE `id` IN (' . $ids . ')'; diff --git a/apps/files_sharing/tests/update.php b/apps/files_sharing/tests/update.php index 86b92b69616..d3555cc2ee3 100644 --- a/apps/files_sharing/tests/update.php +++ b/apps/files_sharing/tests/update.php @@ -176,6 +176,7 @@ class Test_Files_Sharing_Update_Routine extends Test_Files_Sharing_Base { array(\OCP\Share::SHARE_TYPE_USER, 'folder', 'user2', 'admin', '/foo2'), array(\OCP\Share::SHARE_TYPE_USER, 'file', 'user3', 'admin', '/foo3'), array(\OCP\Share::SHARE_TYPE_USER, 'folder', 'user4', 'admin', '/foo4'), + array(\OCP\Share::SHARE_TYPE_USER, 'folder', 'user4', 'admin', "/foo'4"), array(\OCP\Share::SHARE_TYPE_LINK, 'file', 'user1', 'admin', '/ShouldNotChange'), array(\OCP\Share::SHARE_TYPE_CONTACT, 'contact', 'admin', 'user1', '/ShouldNotChange'), |