mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Don't disclose relative directory path for single shared files of user 

The "dir" key is used within the public sharing template to indicate in which directory the user currently is when sharing a directory with subdirectories. This is needed by the JS scripts.

However, when not accessing a directory then "dir" was set to the relative path of the file (from the user's home directory), meaning that for every public shared file the sharee can see the path.
(For example if you share the file "foo.txt" from "finances/topsecret/" the sharee would still see the path "finances/topsecret/" from the shared HTML template)

This is not the excpected behaviour and can be considered a privacy problem, this patch addresses this by setting "dir" to an empty key.
This commit is contained in:
Lukas Reschke 2014-11-18 14:54:08 +01:00 committed by Morris Jobke
parent 5f07fb15dc
commit f3ab4f3faf
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
apps/files_sharing/lib/controllers/sharecontroller.php
View File

@ -172,7 +172,7 @@ class ShareController extends Controller {
$shareTmpl['sharingToken'] = $token;
$shareTmpl['server2serversharing'] = Helper::isOutgoingServer2serverShareEnabled();
$shareTmpl['protected'] = isset($linkItem['share_with']) ? 'true' : 'false';
$shareTmpl['dir'] = $dir;
$shareTmpl['dir'] = '';
$shareTmpl['fileSize'] = \OCP\Util::humanFileSize(\OC\Files\Filesystem::filesize($originalSharePath));
// Show file list

2
apps/files_sharing/tests/controller/sharecontroller.php
View File

@ -153,7 +153,7 @@ class ShareControllerTest extends \PHPUnit_Framework_TestCase {
'sharingToken' => $this->token,
'server2serversharing' => true,
'protected' => 'true',
'dir' => '/',
'dir' => '',
'downloadURL' => null,
'fileSize' => '33 B'
);