diff options
| author | Lukas Reschke <lukas@owncloud.com> | 2014-09-23 11:34:44 +0200 |
|---|---|---|
| committer | Lukas Reschke <lukas@owncloud.com> | 2014-09-23 11:34:44 +0200 |
| commit | 5d977f97b0e0564e3922665530ea468ec069768d (patch) | |
| tree | 29189f07a6125a97a6e695c86fc70f5ab59761a0 /apps/files | |
| parent | fc42a64e6c848adc21bb069da01398f7d39fcc4a (diff) | |
| parent | 6eeb905871fc7a671f99fd22c2592358a6abc02d (diff) | |
| download | nextcloud-server-5d977f97b0e0564e3922665530ea468ec069768d.tar.gz nextcloud-server-5d977f97b0e0564e3922665530ea468ec069768d.zip | |
Merge pull request #11032 from owncloud/harden-redirect
Do only follow HTTP and HTTPS redirects
Diffstat (limited to 'apps/files')
| -rw-r--r-- | apps/files/ajax/newfile.php | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/apps/files/ajax/newfile.php b/apps/files/ajax/newfile.php index 46629e1b602..392fc5bd1c8 100644 --- a/apps/files/ajax/newfile.php +++ b/apps/files/ajax/newfile.php @@ -46,6 +46,7 @@ function progress($notification_code, $severity, $message, $message_code, $bytes } } + $l10n = \OC::$server->getL10N('files'); $result = array( @@ -93,7 +94,8 @@ if (\OC\Files\Filesystem::file_exists($target)) { } if($source) { - if(substr($source, 0, 8)!='https://' and substr($source, 0, 7)!='http://') { + $httpHelper = \OC::$server->getHTTPHelper(); + if(!$httpHelper->isHTTPURL($source)) { OCP\JSON::error(array('data' => array('message' => $l10n->t('Not a valid source')))); exit(); } @@ -104,7 +106,10 @@ if($source) { exit(); } - $ctx = stream_context_create(null, array('notification' =>'progress')); + $source = $httpHelper->getFinalLocationOfURL($source); + + $ctx = stream_context_create(\OC::$server->getHTTPHelper()->getDefaultContextArray(), array('notification' =>'progress')); + $sourceStream=@fopen($source, 'rb', false, $ctx); $result = 0; if (is_resource($sourceStream)) { |