From 0e5d69286678d398b128a0c1bf3c5bea69678691 Mon Sep 17 00:00:00 2001 From: Iscle Date: Thu, 1 Oct 2020 23:47:13 +0200 Subject: [PATCH] DirectController: Verify that expirationTime is between 0s and 24h Signed-off-by: Iscle --- apps/dav/lib/Controller/DirectController.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apps/dav/lib/Controller/DirectController.php b/apps/dav/lib/Controller/DirectController.php index ff7c96ddef..35f4c0dbcb 100644 --- a/apps/dav/lib/Controller/DirectController.php +++ b/apps/dav/lib/Controller/DirectController.php @@ -90,6 +90,10 @@ class DirectController extends OCSController { throw new OCSNotFoundException(); } + if ($expirationTime <= 0 || $expirationTime > (60 * 60 * 24)) { + throw new OCSBadRequestException('Expiration time should be greater than 0 and less than or equal to ' . (60 * 60 * 24)); + } + $file = array_shift($files); if (!($file instanceof File)) { throw new OCSBadRequestException('Direct download only works for files');