Merge pull request #157 from nextcloud/stable10-do-set-albumpath-to-empty-if-error-is-thrownv10.0.1RC1v10.0.1

Stable10 do set albumpath to empty if error is thrown

1 files changed, 21 insertions, 0 deletions

diff --git a/js/galleryview.js b/js/galleryview.js
index eb147c7d..73b6e59a 100644
--- a/js/galleryview.js
+++ b/js/galleryview.js
@@ -37,12 +37,33 @@
 		},
 
 		/**
+		 * @param {string} path
+		 * @returns {boolean}
+		 */
+		_isValidPath: function(path) {
+			var sections = path.split('/');
+			for (var i = 0; i < sections.length; i++) {
+				if (sections[i] === '..') {
+					return false;
+				}
+			}
+
+			return path.toLowerCase().indexOf(decodeURI('%0a')) === -1 &&
+				path.toLowerCase().indexOf(decodeURI('%00')) === -1;
+		},
+
+		/**
 		 * Populates the view if there are images or albums to show
 		 *
 		 * @param {string} albumPath
 		 * @param {string|undefined} errorMessage
 		 */
 		init: function (albumPath, errorMessage) {
+			// Set path to an empty value if not a valid one
+			if(!this._isValidPath(albumPath)) {
+				albumPath = '';
+			}
+
 			// Only do it when the app is initialised
 			if (this.requestId === -1) {
 				this._initButtons();