From 7b1b723e5b04173409117aca1f7e76bed5762d9f Mon Sep 17 00:00:00 2001
From: Robin Appelman <icewind@owncloud.com>
Date: Mon, 30 May 2016 15:44:19 +0200
Subject: dissalow symlinks in local storages that point outside the datadir

---
 lib/private/Files/Storage/Local.php | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

(limited to 'lib/private/Files/Storage')

diff --git a/lib/private/Files/Storage/Local.php b/lib/private/Files/Storage/Local.php
index acd4c3b4838..005b5f9ab91 100644
--- a/lib/private/Files/Storage/Local.php
+++ b/lib/private/Files/Storage/Local.php
@@ -33,20 +33,31 @@
  */
 
 namespace OC\Files\Storage;
+
+use OCP\Files\ForbiddenException;
+
 /**
  * for local filestore, we only have to map the paths
  */
 class Local extends \OC\Files\Storage\Common {
 	protected $datadir;
 
+	protected $dataDirLength;
+
+	protected $allowSymlinks = false;
+
+	protected $realDataDir;
+
 	public function __construct($arguments) {
 		if (!isset($arguments['datadir']) || !is_string($arguments['datadir'])) {
 			throw new \InvalidArgumentException('No data directory set for local storage');
 		}
 		$this->datadir = $arguments['datadir'];
+		$this->realDataDir = rtrim(realpath($this->datadir), '/') . '/';
 		if (substr($this->datadir, -1) !== '/') {
 			$this->datadir .= '/';
 		}
+		$this->dataDirLength = strlen($this->realDataDir);
 	}
 
 	public function __destruct() {
@@ -337,10 +348,27 @@ class Local extends \OC\Files\Storage\Common {
 	 *
 	 * @param string $path
 	 * @return string
+	 * @throws ForbiddenException
 	 */
 	public function getSourcePath($path) {
 		$fullPath = $this->datadir . $path;
-		return $fullPath;
+		if ($this->allowSymlinks || $path === '') {
+			return $fullPath;
+		}
+		$pathToResolve = $fullPath;
+		$realPath = realpath($pathToResolve);
+		while ($realPath === false) { // for non existing files check the parent directory
+			$pathToResolve = dirname($pathToResolve);
+			$realPath = realpath($pathToResolve);
+		}
+		if ($realPath) {
+			$realPath = $realPath . '/';
+		}
+		if (substr($realPath, 0, $this->dataDirLength) === $this->realDataDir) {
+			return $fullPath;
+		} else {
+			throw new ForbiddenException("Following symlinks is not allowed ('$fullPath' -> '$realPath' not inside '{$this->realDataDir}')", false);
+		}
 	}
 
 	/**
-- 
cgit v1.2.3