RPJosh
/
memories
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sec: better path sanitization 

Signed-off-by: Varun Patil <varunpatil@ucla.edu>
pull/579/head
Varun Patil 2023-04-16 15:58:11 -07:00
parent c25dd6e640
commit 83be3c93b1
3 changed files with 6 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/Controller/ArchiveController.php
View File

@ -134,7 +134,7 @@ class ArchiveController extends GenericApiController
} else {
// file not in archive, put it in there
$af = \OCA\Memories\Util::$ARCHIVE_FOLDER;
$destinationPath = Exif::removeExtraSlash($af.$relativeFilePath);
$destinationPath = Exif::sanitizePath($af.$relativeFilePath);
}
// Remove the filename

4
lib/Db/FsManager.php
View File

@ -103,13 +103,13 @@ class FsManager
try {
if (null !== $folderPath) {
$folder = $userFolder->get(Exif::removeExtraSlash($folderPath));
$folder = $userFolder->get(Exif::sanitizePath($folderPath));
$root->addFolder($folder);
} else {
// Get timeline paths
$paths = Exif::getTimelinePaths($uid);
if ($path = $this->request->getParam('timelinePath', null)) {
$paths = [Exif::removeExtraSlash($path)];
$paths = [Exif::sanitizePath($path)];
}
// Combined etag, for cache invalidation.

12
lib/Exif.php
View File

@ -81,15 +81,9 @@ class Exif
*/
public static function sanitizePath(string $path)
{
return mb_ereg_replace('([^\\w\\s\\d\\-_~,;:!@#$&*{}\[\]\'\\[\\]\\(\\).\\\/])', '', $path);
}
/**
* Keep only one slash if multiple repeating.
*/
public static function removeExtraSlash(string $path)
{
return mb_ereg_replace('\/\/+', '/', $path);
$path = mb_ereg_replace('([^\\w\\s\\d\\-_~,;:!@#$&*{}\[\]\'\\[\\]\\(\\).\\\/])', '', $path);
$path = mb_ereg_replace('\/\/+', '/', $path); // remove extra slashes
return $path;
}
/**