Do not allow invalid users to be created

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

1 files changed, 14 insertions, 0 deletions

diff --git a/lib/private/User/Manager.php b/lib/private/User/Manager.php
index 62f02915c39..4e3eea37336 100644
--- a/lib/private/User/Manager.php
+++ b/lib/private/User/Manager.php
@@ -279,6 +279,10 @@ class Manager extends PublicEmitter implements IUserManager {
 	 * @return bool|IUser the created user or false
 	 */
 	public function createUser($uid, $password) {
+		if (!$this->verifyUid($uid)) {
+			return false;
+		}
+
 		$localBackends = [];
 		foreach ($this->backends as $backend) {
 			if ($backend instanceof Database) {
@@ -598,4 +602,14 @@ class Manager extends PublicEmitter implements IUserManager {
 			return ($u instanceof IUser);
 		}));
 	}
+
+	private function verifyUid(string $uid): bool {
+		$appdata = 'appdata_' . $this->config->getSystemValueString('instanceid');
+
+		if ($uid === '.htaccess' || $uid === 'files_external' || $uid === '.ocdata' || $uid === 'owncloud.log' || $uid === 'nextcloud.log' || $uid === $appdata) {
+			return false;
+		}
+
+		return true;
+	}
 }