From 363963577c97b6f87df47f424ce6f43c82cadfab Mon Sep 17 00:00:00 2001
From: Roeland Jago Douma <roeland@famdouma.nl>
Date: Fri, 2 Dec 2016 10:03:02 +0100
Subject: [PATCH] Harden files drop

* Fail on MKCOL
* Only take filename ignore directories
* No need to parse query parameters

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
---
 .../dav/lib/Files/Sharing/FilesDropPlugin.php | 30 +++++++------------
 1 file changed, 10 insertions(+), 20 deletions(-)

diff --git a/apps/dav/lib/Files/Sharing/FilesDropPlugin.php b/apps/dav/lib/Files/Sharing/FilesDropPlugin.php
index 299427b163..3485df09d0 100644
--- a/apps/dav/lib/Files/Sharing/FilesDropPlugin.php
+++ b/apps/dav/lib/Files/Sharing/FilesDropPlugin.php
@@ -23,6 +23,7 @@
 namespace OCA\DAV\Files\Sharing;
 
 use OC\Files\View;
+use Sabre\DAV\Exception\MethodNotAllowed;
 use Sabre\DAV\ServerPlugin;
 use Sabre\HTTP\RequestInterface;
 use Sabre\HTTP\ResponseInterface;
@@ -56,6 +57,7 @@ class FilesDropPlugin extends ServerPlugin {
 	 * @param \Sabre\DAV\Server $server Sabre server
 	 *
 	 * @return void
+	 * @throws MethodNotAllowed
 	 */
 	public function initialize(\Sabre\DAV\Server $server) {
 		$server->on('beforeMethod', [$this, 'beforeMethod'], 999);
@@ -64,31 +66,19 @@ class FilesDropPlugin extends ServerPlugin {
 
 	public function beforeMethod(RequestInterface $request, ResponseInterface $response){
 
-		if (!$this->enabled || $request->getMethod() !== 'PUT') {
+		if (!$this->enabled) {
 			return;
 		}
 
-		$path = $request->getPath();
-
-		if ($this->view->file_exists($path)) {
-			$newName = \OC_Helper::buildNotExistingFileNameForView('/', $path, $this->view);
-
-			$url = $request->getBaseUrl() . $newName . '?';
-			$parms = $request->getQueryParameters();
-			$first = true;
-			foreach ($parms as $k => $v) {
-				if ($first) {
-					$url .= '?';
-					$first = false;
-				} else {
-					$url .= '&';
-				}
-				$url .= $k . '=' . $v;
-			}
-
-			$request->setUrl($url);
+		if ($request->getMethod() !== 'PUT') {
+			throw new MethodNotAllowed('Only PUT is allowed on files drop');
 		}
 
+		$path = explode('/', $request->getPath());
+		$path = array_pop($path);
 
+		$newName = \OC_Helper::buildNotExistingFileNameForView('/', $path, $this->view);
+		$url = $request->getBaseUrl() . $newName;
+		$request->setUrl($url);
 	}
 }