diff options
| author | Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com> | 2024-11-28 11:05:06 +0100 |
|---|---|---|
| committer | backportbot[bot] <backportbot[bot]@users.noreply.github.com> | 2024-11-28 10:46:58 +0000 |
| commit | 56a31b3b406247593774d25dbd9f84977156cdfc (patch) | |
| tree | 42288c1abb346084cb2530308122d60f1459bf06 | |
| parent | 00ece1357cda8f36765a5ff971bba591ee9e2220 (diff) | |
| download | nextcloud-server-56a31b3b406247593774d25dbd9f84977156cdfc.tar.gz nextcloud-server-56a31b3b406247593774d25dbd9f84977156cdfc.zip | |
chore: stricter access to testremote endpoint
Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
| -rw-r--r-- | apps/files_sharing/lib/Controller/ExternalSharesController.php | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/apps/files_sharing/lib/Controller/ExternalSharesController.php b/apps/files_sharing/lib/Controller/ExternalSharesController.php index 726e99345fa..d62df7a071d 100644 --- a/apps/files_sharing/lib/Controller/ExternalSharesController.php +++ b/apps/files_sharing/lib/Controller/ExternalSharesController.php @@ -118,9 +118,10 @@ class ExternalSharesController extends Controller { * * @param string $remote * @return DataResponse + * @AnonRateThrottle(limit=5, period=120) */ public function testRemote($remote) { - if (str_contains($remote, '#') || str_contains($remote, '?') || str_contains($remote, ';')) { + if (preg_match('%[!#$&\'()*+,;=?@[\]]%', $remote)) { return new DataResponse(false); } |