diff options
| author | Lukas Reschke <lukas@owncloud.com> | 2014-10-16 15:54:21 +0400 |
|---|---|---|
| committer | Lukas Reschke <lukas@owncloud.com> | 2014-10-16 15:54:21 +0400 |
| commit | 870dc981aa302567f0be39d778460e01da926809 (patch) | |
| tree | 142e7a5f384cf7732ecb587c11dd9b1420a770d2 /apps/files | |
| parent | 784931f835b4beb2a0af892cde249160bf1721e0 (diff) | |
| parent | b2798afef5f7137484bb19e432014b7d8a088e22 (diff) | |
Merge pull request #11248 from owncloud/11032-backport-stable6
Do only follow HTTP and HTTPS redirects
Diffstat (limited to 'apps/files')
| -rw-r--r-- | apps/files/ajax/newfile.php | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/apps/files/ajax/newfile.php b/apps/files/ajax/newfile.php index 4943f8793af..4e9d51a1940 100644 --- a/apps/files/ajax/newfile.php +++ b/apps/files/ajax/newfile.php @@ -77,8 +77,9 @@ if (\OC\Files\Filesystem::file_exists($target)) { } if($source) { - if(substr($source, 0, 8)!='https://' and substr($source, 0, 7)!='http://') { - OCP\JSON::error(array('data' => array( 'message' => $l10n->t('Not a valid source') ))); + $httpHelper = \OC::$server->getHTTPHelper(); + if(!$httpHelper->isHTTPURL($source)) { + OCP\JSON::error(array('data' => array('message' => $l10n->t('Not a valid source')))); exit(); } @@ -88,7 +89,10 @@ if($source) { exit(); } - $ctx = stream_context_create(null, array('notification' =>'progress')); + $source = $httpHelper->getFinalLocationOfURL($source); + + $ctx = stream_context_create(\OC::$server->getHTTPHelper()->getDefaultContextArray(), array('notification' =>'progress')); + $sourceStream=@fopen($source, 'rb', false, $ctx); $result = 0; if (is_resource($sourceStream)) { |