diff options
| author | Lukas Reschke <lukas@owncloud.com> | 2015-02-13 13:33:20 +0100 |
|---|---|---|
| committer | Lukas Reschke <lukas@owncloud.com> | 2015-02-13 13:33:20 +0100 |
| commit | a7df23cebadfc0a60095ff53e4ae5e293eb02b38 (patch) | |
| tree | 54e8fd3e3179c65e8abda8e3bc61ce6547a501c6 /apps/files/ajax/newfile.php | |
| parent | 51f8d240c1c7a2c5fe4ab89854aeae02a33406b4 (diff) | |
| download | nextcloud-server-a7df23cebadfc0a60095ff53e4ae5e293eb02b38.tar.gz nextcloud-server-a7df23cebadfc0a60095ff53e4ae5e293eb02b38.zip | |
Manually type-case all AJAX files
This enforces proper types on POST and GET arguments where I considered it sensible. I didn't update some as I don't know what kind of values they would support :see_no_evil:
Fixes https://github.com/owncloud/core/issues/14196 for core
Diffstat (limited to 'apps/files/ajax/newfile.php')
| -rw-r--r-- | apps/files/ajax/newfile.php | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/apps/files/ajax/newfile.php b/apps/files/ajax/newfile.php index 159a8b5d7a3..4f5d102b404 100644 --- a/apps/files/ajax/newfile.php +++ b/apps/files/ajax/newfile.php @@ -9,10 +9,10 @@ global $eventSource; \OC::$server->getSession()->close(); // Get the params -$dir = isset( $_REQUEST['dir'] ) ? '/'.trim($_REQUEST['dir'], '/\\') : ''; -$filename = isset( $_REQUEST['filename'] ) ? trim($_REQUEST['filename'], '/\\') : ''; -$content = isset( $_REQUEST['content'] ) ? $_REQUEST['content'] : ''; -$source = isset( $_REQUEST['source'] ) ? trim($_REQUEST['source'], '/\\') : ''; +$dir = isset( $_REQUEST['dir'] ) ? '/'.trim((string)$_REQUEST['dir'], '/\\') : ''; +$filename = isset( $_REQUEST['filename'] ) ? trim((string)$_REQUEST['filename'], '/\\') : ''; +$content = isset( $_REQUEST['content'] ) ? (string)$_REQUEST['content'] : ''; +$source = isset( $_REQUEST['source'] ) ? trim((string)$_REQUEST['source'], '/\\') : ''; if($source) { $eventSource = \OC::$server->createEventSource(); |