diff options
| author | Lukas Reschke <lukas@owncloud.com> | 2015-03-26 23:14:24 +0100 |
|---|---|---|
| committer | Lukas Reschke <lukas@owncloud.com> | 2015-03-26 23:17:18 +0100 |
| commit | 9622fbdf292298458427ac6a33d65aba8f07b395 (patch) | |
| tree | 3b9ec081b97e503bf72c17ca893f9e0f81bb8a29 /lib/private/tempmanager.php | |
| parent | 746be98e0387ea138c4413fb89ad7e9ee87ce7aa (diff) | |
| download | nextcloud-server-9622fbdf292298458427ac6a33d65aba8f07b395.tar.gz nextcloud-server-9622fbdf292298458427ac6a33d65aba8f07b395.zip | |
Filter potential dangerous characters in path name
We should not allow / or \ in the postfix here.
Diffstat (limited to 'lib/private/tempmanager.php')
| -rw-r--r-- | lib/private/tempmanager.php | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/lib/private/tempmanager.php b/lib/private/tempmanager.php index 197c0233142..5ab1427c505 100644 --- a/lib/private/tempmanager.php +++ b/lib/private/tempmanager.php @@ -54,10 +54,15 @@ class TempManager implements ITempManager { $this->log = $logger; } + /** + * @param string $postFix + * @return string + */ protected function generatePath($postFix) { if ($postFix) { $postFix = '.' . ltrim($postFix, '.'); } + $postFix = str_replace(['\\', '/'], '', $postFix); return $this->tmpBaseDir . '/oc_tmp_' . md5(time() . rand()) . $postFix; } |