From c3ae21fef2880c9fe44e8fdbe1262ac7f9716f14 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Thu, 1 Sep 2016 12:24:14 +0200
Subject: [PATCH] Also prevent null byte character

---
 apps/files/js/filelist.js           | 3 ++-
 apps/files/tests/js/filelistSpec.js | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/apps/files/js/filelist.js b/apps/files/js/filelist.js
index 32de261ea6..607c82b7d2 100644
--- a/apps/files/js/filelist.js
+++ b/apps/files/js/filelist.js
@@ -1412,7 +1412,8 @@
 				}
 			}
 
-			return path.toLowerCase().indexOf(decodeURI('%0a')) === -1;
+			return path.toLowerCase().indexOf(decodeURI('%0a')) === -1 &&
+				path.toLowerCase().indexOf(decodeURI('%00')) === -1;
 		},
 
 		/**
diff --git a/apps/files/tests/js/filelistSpec.js b/apps/files/tests/js/filelistSpec.js
index fd11a58b68..82b70141b7 100644
--- a/apps/files/tests/js/filelistSpec.js
+++ b/apps/files/tests/js/filelistSpec.js
@@ -1380,6 +1380,7 @@ describe('OCA.Files.FileList tests', function() {
 				'/abc/../',
 				'/../abc/',
 				'/foo%0Abar/',
+				'/foo%00bar/',
 				'/another\\subdir/../foo\\../bar\\..\\file/..\\folder/../'
 			], function(path) {
 				fileList.changeDirectory(decodeURI(path));