diff options
| author | Lukas Reschke <lukas@owncloud.com> | 2014-09-11 19:21:56 +0200 |
|---|---|---|
| committer | Lukas Reschke <lukas@owncloud.com> | 2014-09-22 20:02:32 +0200 |
| commit | 6eeb905871fc7a671f99fd22c2592358a6abc02d (patch) | |
| tree | 391889ddb92d83a766a109cd7fc6bd58a4805691 /apps/files/ajax | |
| parent | 70937dabcdf60a047000347523bfee7a53e673e6 (diff) | |
| download | nextcloud-server-6eeb905871fc7a671f99fd22c2592358a6abc02d.tar.gz nextcloud-server-6eeb905871fc7a671f99fd22c2592358a6abc02d.zip | |
Do only follow HTTP and HTTPS redirects
We do not want to follow redirects to other protocols since they might allow an adversary to bypass network restrictions. (i.e. a redirect to ftp:// might be used to access files of a FTP server which might be in a secure zone and not be reachable from the net but from the ownCloud server)
Get final redirect manually using get_headers()
Migrate to HTTPHelper class and add unit tests
Diffstat (limited to 'apps/files/ajax')
| -rw-r--r-- | apps/files/ajax/newfile.php | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/apps/files/ajax/newfile.php b/apps/files/ajax/newfile.php index 46629e1b602..392fc5bd1c8 100644 --- a/apps/files/ajax/newfile.php +++ b/apps/files/ajax/newfile.php @@ -46,6 +46,7 @@ function progress($notification_code, $severity, $message, $message_code, $bytes } } + $l10n = \OC::$server->getL10N('files'); $result = array( @@ -93,7 +94,8 @@ if (\OC\Files\Filesystem::file_exists($target)) { } if($source) { - if(substr($source, 0, 8)!='https://' and substr($source, 0, 7)!='http://') { + $httpHelper = \OC::$server->getHTTPHelper(); + if(!$httpHelper->isHTTPURL($source)) { OCP\JSON::error(array('data' => array('message' => $l10n->t('Not a valid source')))); exit(); } @@ -104,7 +106,10 @@ if($source) { exit(); } - $ctx = stream_context_create(null, array('notification' =>'progress')); + $source = $httpHelper->getFinalLocationOfURL($source); + + $ctx = stream_context_create(\OC::$server->getHTTPHelper()->getDefaultContextArray(), array('notification' =>'progress')); + $sourceStream=@fopen($source, 'rb', false, $ctx); $result = 0; if (is_resource($sourceStream)) { |