diff options
| author | Lukas Reschke <lukas@statuscode.ch> | 2016-06-10 18:29:09 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2016-06-10 18:29:09 +0200 |
| commit | 842cc2a7889d1ff8004fddd2546aec1232e0eaed (patch) | |
| tree | e309a759b4ebee9ab9fa32d839d8ebb819c145f6 /apps/files | |
| parent | 74580daa23016fab370b2f6c14d82401032733cb (diff) | |
| parent | 54e2ac57130666add0ad5d3c583c6f29527b4ebc (diff) | |
| download | nextcloud-server-842cc2a7889d1ff8004fddd2546aec1232e0eaed.tar.gz nextcloud-server-842cc2a7889d1ff8004fddd2546aec1232e0eaed.zip | |
Merge pull request #19 from nextcloud/files-drop
add "hide file list" option
Diffstat (limited to 'apps/files')
| -rw-r--r-- | apps/files/ajax/upload.php | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/apps/files/ajax/upload.php b/apps/files/ajax/upload.php index 9cc9c279700..98066845734 100644 --- a/apps/files/ajax/upload.php +++ b/apps/files/ajax/upload.php @@ -161,6 +161,15 @@ if (\OC\Files\Filesystem::isValidPath($dir) === true) { $resolution = null; } + if(isset($_POST['dirToken'])) { + // If it is a read only share the resolution will always be autorename + $shareManager = \OC::$server->getShareManager(); + $share = $shareManager->getShareByToken((string)$_POST['dirToken']); + if (!($share->getPermissions() & \OCP\Constants::PERMISSION_READ)) { + $resolution = 'autorename'; + } + } + // target directory for when uploading folders $relativePath = ''; if(!empty($_POST['file_directory'])) { @@ -247,6 +256,20 @@ if (\OC\Files\Filesystem::isValidPath($dir) === true) { } if ($error === false) { + // Do not leak file information if it is a read-only share + if(isset($_POST['dirToken'])) { + $shareManager = \OC::$server->getShareManager(); + $share = $shareManager->getShareByToken((string)$_POST['dirToken']); + if (!($share->getPermissions() & \OCP\Constants::PERMISSION_READ)) { + $newResults = []; + foreach($result as $singleResult) { + $fileName = $singleResult['originalname']; + $newResults['filename'] = $fileName; + $newResults['mimetype'] = \OC::$server->getMimeTypeDetector()->detectPath($fileName); + } + $result = $newResults; + } + } OCP\JSON::encodedPrint($result); } else { OCP\JSON::error(array(array('data' => array_merge(array('message' => $error, 'code' => $errorCode), $storageStats)))); |