diff options
| author | John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com> | 2018-12-18 09:17:49 +0100 |
|---|---|---|
| committer | Backportbot <backportbot-noreply@rullzer.com> | 2018-12-19 08:55:43 +0000 |
| commit | 5eff452b2379423edab73354828d17cf20d7c511 (patch) | |
| tree | b264bcceab197a8f90f1cef20af4d6817b73974a /apps | |
| parent | daea45c4241f2d585b82a748909651ca95fc9ee3 (diff) | |
| download | nextcloud-server-5eff452b2379423edab73354828d17cf20d7c511.tar.gz nextcloud-server-5eff452b2379423edab73354828d17cf20d7c511.zip | |
Prevent special characters from breaking the file drop remote url
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
Diffstat (limited to 'apps')
| -rw-r--r-- | apps/files_sharing/js/files_drop.js | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/apps/files_sharing/js/files_drop.js b/apps/files_sharing/js/files_drop.js index 8d1273f1872..9f3caf62ce0 100644 --- a/apps/files_sharing/js/files_drop.js +++ b/apps/files_sharing/js/files_drop.js @@ -35,7 +35,11 @@ useHTTPS: OC.getProtocol() === 'https' }); + // We only process one file at a time 🤷♀️ var name = data.files[0].name; + // removing unwanted characters + name = name.replace(/["'#%`]/gm, ''); + try { // FIXME: not so elegant... need to refactor that method to return a value Files.isFileNameValid(name); |