mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix a chroot issue where the path /.. (and related paths) are not caught and removed. 

Signed-off-by: Matthew Dawson <matthew@mjdsystems.ca>
This commit is contained in:
Matthew Dawson 2011-01-03 17:46:18 -05:00
parent 290b2d7355
commit 61ce6e21ec
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
inc/lib_filesystem.php
View File

@ -111,7 +111,7 @@ class OC_FILESYSTEM{
if(substr($path,0,1)!=='/'){
$path='/'.$path;
}
if(strstr($path,'/../')){
if(strstr($path,'/../') || strrchr($path, '/') === '/..' ){
return false;
}
return true;//dummy untill premissions are correctly implemented, also the correcty value because for now users are locked in their seperate data dir and can read/write everything in there