mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #16128 from nextcloud/backport/16107/stable16 

[stable16] verify that paths are valid for recursive local move
This commit is contained in:
Roeland Jago Douma 2019-06-27 22:12:10 +02:00 committed by GitHub
parent 0f8a3e8fc2 555b62a619
commit 34e28920c5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
lib/private/Files/Storage/Local.php
View File

@ -39,6 +39,7 @@
namespace OC\Files\Storage;
use OC\Files\Filesystem;
use OC\Files\Storage\Wrapper\Jail;
use OCP\Files\ForbiddenException;
use OCP\Files\Storage\IStorage;
@ -231,6 +232,18 @@ class Local extends \OC\Files\Storage\Common {
}
private function treeContainsBlacklistedFile(string $path): bool {
$iterator = new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($path));
foreach ($iterator as $file) {
/** @var \SplFileInfo $file */
if (Filesystem::isFileBlacklisted($file->getBasename())) {
return true;
}
}
return false;
}
public function rename($path1, $path2) {
$srcParent = dirname($path1);
$dstParent = dirname($path2);
@ -267,6 +280,10 @@ class Local extends \OC\Files\Storage\Common {
}
return $result;
}
if ($this->treeContainsBlacklistedFile($this->getSourcePath($path1))) {
throw new ForbiddenException('Invalid path', false);
}
}
return rename($this->getSourcePath($path1), $this->getSourcePath($path2));
@ -362,6 +379,10 @@ class Local extends \OC\Files\Storage\Common {
* @throws ForbiddenException
*/
public function getSourcePath($path) {
if (Filesystem::isFileBlacklisted($path)) {
throw new ForbiddenException('Invalid path', false);
}
$fullPath = $this->datadir . $path;
$currentPath = $path;
if ($this->allowSymlinks || $currentPath === '') {