diff options
| author | Lukas Reschke <lukas@owncloud.com> | 2015-05-22 11:53:02 +0200 |
|---|---|---|
| committer | Lukas Reschke <lukas@owncloud.com> | 2015-05-22 11:53:02 +0200 |
| commit | 8ce3d6ea57a2181afddc03e154495b6ddeb6c6be (patch) | |
| tree | 2227267b88cf02e3dc224dfac626a2c02845c390 /lib/private/files.php | |
| parent | 94077caea90e3646c77fdae69ea63fc84e1f8409 (diff) | |
| download | nextcloud-server-8ce3d6ea57a2181afddc03e154495b6ddeb6c6be.tar.gz nextcloud-server-8ce3d6ea57a2181afddc03e154495b6ddeb6c6be.zip | |
End processing when file is not found
We have to end the processing when a file is not found or otherwise the method is proceeding and even sending invalid file paths to the sendfile methods.
Due to nginx preventing directory traversals this is luckily not immediately exploitable. We should for hardening purposes however quit the script execution just as we do for 403 cases and others as well.
Diffstat (limited to 'lib/private/files.php')
| -rw-r--r-- | lib/private/files.php | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/lib/private/files.php b/lib/private/files.php index 6a739fc844c..5a3e1029199 100644 --- a/lib/private/files.php +++ b/lib/private/files.php @@ -138,6 +138,7 @@ class OC_Files { header("HTTP/1.0 404 Not Found"); $tmpl = new OC_Template('', '404', 'guest'); $tmpl->printPage(); + exit(); } else { header("HTTP/1.0 403 Forbidden"); die('403 Forbidden'); |