diff options
author | Robin Appelman <icewind@owncloud.com> | 2012-06-06 02:02:13 +0400 |
---|---|---|
committer | Robin Appelman <icewind@owncloud.com> | 2012-06-06 02:04:02 +0400 |
commit | 063c9accb6772001ade8bea1251cd0d9bd000e15 (patch) | |
tree | 44da8474f65f08d6e413bd5b17b482120014bfba /apps | |
parent | 3a5076d6462376082d4b7f05cbdfb741f0479238 (diff) |
prevent creating files with a / the name
Diffstat (limited to 'apps')
-rw-r--r-- | apps/files/ajax/newfile.php | 4 | ||||
-rw-r--r-- | apps/files/ajax/newfolder.php | 4 | ||||
-rw-r--r-- | apps/files/js/files.js | 5 |
3 files changed, 13 insertions, 0 deletions
diff --git a/apps/files/ajax/newfile.php b/apps/files/ajax/newfile.php index 316eac0562d..edb78414872 100644 --- a/apps/files/ajax/newfile.php +++ b/apps/files/ajax/newfile.php @@ -15,6 +15,10 @@ if($filename == '') { OCP\JSON::error(array("data" => array( "message" => "Empty Filename" ))); exit(); } +if(strpos($filename,'/')!==false){ + OCP\JSON::error(array("data" => array( "message" => "Invalid Filename" ))); + exit(); +} if($source){ if(substr($source,0,8)!='https://' and substr($source,0,7)!='http://'){ diff --git a/apps/files/ajax/newfolder.php b/apps/files/ajax/newfolder.php index 512e0e1f6d9..0668a6191f4 100644 --- a/apps/files/ajax/newfolder.php +++ b/apps/files/ajax/newfolder.php @@ -13,6 +13,10 @@ if(trim($foldername) == '') { OCP\JSON::error(array("data" => array( "message" => "Empty Foldername" ))); exit(); } +if(strpos($filename,'/')!==false){ + OCP\JSON::error(array("data" => array( "message" => "Invalid Foldername" ))); + exit(); +} if(OC_Files::newFile($dir, stripslashes($foldername), 'dir')) { OCP\JSON::success(array("data" => array())); diff --git a/apps/files/js/files.js b/apps/files/js/files.js index 40d5be2214a..db29b22275c 100644 --- a/apps/files/js/files.js +++ b/apps/files/js/files.js @@ -448,6 +448,11 @@ $(document).ready(function() { input.focus(); input.change(function(){ var name=$(this).val(); + if(name.indexOf('/')!=-1){ + $('#notification').text(t('files','Invalid name, \'/\' is not allowed.')); + $('#notification').fadeIn(); + return; + } switch(type){ case 'file': $.post( |