Prevent directory traversals in ctr of \OC\Files\View

This prevents a misusage of \OC\Files\View by calling it with user-supplied input. In such cases an exception is now thrown.

1 files changed, 8 insertions, 0 deletions

diff --git a/lib/private/files/view.php b/lib/private/files/view.php
index 3bc9fdff1ee..3dfd4d0c105 100644
--- a/lib/private/files/view.php
+++ b/lib/private/files/view.php
@@ -36,7 +36,15 @@ class View {
 	 */
 	protected $updater;
 
+	/**
+	 * @param string $root
+	 * @throws \Exception If $root contains an invalid path
+	 */
 	public function __construct($root = '') {
+		if(!Filesystem::isValidPath($root)) {
+			throw new \Exception();
+		}
+
 		$this->fakeRoot = $root;
 		$this->updater = new Updater($this);
 	}