diff options
| author | Michael Gapczynski <GapczynskiM@gmail.com> | 2012-05-29 12:31:47 -0400 |
|---|---|---|
| committer | Michael Gapczynski <GapczynskiM@gmail.com> | 2012-05-29 12:35:52 -0400 |
| commit | 1d983c28aa2c9494420a06fdd1ce2b7d0a56e050 (patch) | |
| tree | 9ecb4111e7e4b68f9bd26a8920ff15a9e30e68b8 /lib/base.php | |
| parent | 6515c5c1e77e4abd8e9d504c1cec6455946bf52c (diff) | |
| download | nextcloud-server-1d983c28aa2c9494420a06fdd1ce2b7d0a56e050.tar.gz nextcloud-server-1d983c28aa2c9494420a06fdd1ce2b7d0a56e050.zip | |
Restrict requested app to apps directory
Diffstat (limited to 'lib/base.php')
| -rw-r--r-- | lib/base.php | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/base.php b/lib/base.php index f6c29a51dd8..30d302b3912 100644 --- a/lib/base.php +++ b/lib/base.php @@ -430,7 +430,7 @@ class OC{ register_shutdown_function(array('OC_Helper','cleanTmp')); //parse the given parameters - self::$REQUESTEDAPP = (isset($_GET['app'])?str_replace('\0', '', strip_tags($_GET['app'])):OC_Config::getValue('defaultapp', 'files')); + self::$REQUESTEDAPP = (isset($_GET['app'])?str_replace(array('\0', '/', '\\', '..'), '', strip_tags($_GET['app'])):OC_Config::getValue('defaultapp', 'files')); if(substr_count(self::$REQUESTEDAPP, '?') != 0){ $app = substr(self::$REQUESTEDAPP, 0, strpos(self::$REQUESTEDAPP, '?')); $param = substr(self::$REQUESTEDAPP, strpos(self::$REQUESTEDAPP, '?') + 1); |