Merge pull request #158 from nextcloud/stable9-do-set-albumpath-to-empty-if-error-is-thrownv9.0.58RC1v9.0.57RC1v9.0.57v9.0.56RC1v9.0.56v9.0.55v9.0.54RC1v9.0.54

Stable9 do set albumpath to empty if error is thrown

1 files changed, 21 insertions, 0 deletions

diff --git a/js/galleryview.js b/js/galleryview.js
index 370a88e7..16fbdb26 100644
--- a/js/galleryview.js
+++ b/js/galleryview.js
@@ -27,11 +27,32 @@
 		},
 
 		/**
+		 * @param {string} path
+		 * @returns {boolean}
+		 */
+		_isValidPath: function(path) {
+			var sections = path.split('/');
+			for (var i = 0; i < sections.length; i++) {
+				if (sections[i] === '..') {
+					return false;
+				}
+			}
+
+			return path.toLowerCase().indexOf(decodeURI('%0a')) === -1 &&
+				path.toLowerCase().indexOf(decodeURI('%00')) === -1;
+		},
+
+		/**
 		 * Populates the view if there are images or albums to show
 		 *
 		 * @param {string} albumPath
 		 */
 		init: function (albumPath) {
+			// Set path to an empty value if not a valid one
+			if(!this._isValidPath(albumPath)) {
+				albumPath = '';
+			}
+
 			// Only do it when the app is initialised
 			if (this.requestId === -1) {
 				this._initButtons();