diff options
| author | Robin Appelman <icewind@owncloud.com> | 2012-06-06 00:02:13 +0200 |
|---|---|---|
| committer | Robin Appelman <icewind@owncloud.com> | 2012-06-06 00:02:51 +0200 |
| commit | e6c4e53486b7c1a2f9da7b3ebca3b2581406fb92 (patch) | |
| tree | d1588e49eea8e5cc1380b7f6d00be09c00b0911a /apps/files/ajax | |
| parent | 3ce6344d40385e38335fb9716233cbf7c5241860 (diff) | |
| download | nextcloud-server-e6c4e53486b7c1a2f9da7b3ebca3b2581406fb92.tar.gz nextcloud-server-e6c4e53486b7c1a2f9da7b3ebca3b2581406fb92.zip | |
prevent creating files with a / the name
Diffstat (limited to 'apps/files/ajax')
| -rw-r--r-- | apps/files/ajax/newfile.php | 4 | ||||
| -rw-r--r-- | apps/files/ajax/newfolder.php | 4 |
2 files changed, 8 insertions, 0 deletions
diff --git a/apps/files/ajax/newfile.php b/apps/files/ajax/newfile.php index 316eac0562d..edb78414872 100644 --- a/apps/files/ajax/newfile.php +++ b/apps/files/ajax/newfile.php @@ -15,6 +15,10 @@ if($filename == '') { OCP\JSON::error(array("data" => array( "message" => "Empty Filename" ))); exit(); } +if(strpos($filename,'/')!==false){ + OCP\JSON::error(array("data" => array( "message" => "Invalid Filename" ))); + exit(); +} if($source){ if(substr($source,0,8)!='https://' and substr($source,0,7)!='http://'){ diff --git a/apps/files/ajax/newfolder.php b/apps/files/ajax/newfolder.php index 512e0e1f6d9..0668a6191f4 100644 --- a/apps/files/ajax/newfolder.php +++ b/apps/files/ajax/newfolder.php @@ -13,6 +13,10 @@ if(trim($foldername) == '') { OCP\JSON::error(array("data" => array( "message" => "Empty Foldername" ))); exit(); } +if(strpos($filename,'/')!==false){ + OCP\JSON::error(array("data" => array( "message" => "Invalid Foldername" ))); + exit(); +} if(OC_Files::newFile($dir, stripslashes($foldername), 'dir')) { OCP\JSON::success(array("data" => array())); |