From 1d983c28aa2c9494420a06fdd1ce2b7d0a56e050 Mon Sep 17 00:00:00 2001
From: Michael Gapczynski <GapczynskiM@gmail.com>
Date: Tue, 29 May 2012 12:31:47 -0400
Subject: [PATCH] Restrict requested app to apps directory
---
lib/base.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/base.php b/lib/base.php
index f6c29a51dd..30d302b391 100644
--- a/lib/base.php
+++ b/lib/base.php
@@ -430,7 +430,7 @@ class OC{
register_shutdown_function(array('OC_Helper','cleanTmp'));
//parse the given parameters
- self::$REQUESTEDAPP = (isset($_GET['app'])?str_replace('\0', '', strip_tags($_GET['app'])):OC_Config::getValue('defaultapp', 'files'));
+ self::$REQUESTEDAPP = (isset($_GET['app'])?str_replace(array('\0', '/', '\\', '..'), '', strip_tags($_GET['app'])):OC_Config::getValue('defaultapp', 'files'));
if(substr_count(self::$REQUESTEDAPP, '?') != 0){
$app = substr(self::$REQUESTEDAPP, 0, strpos(self::$REQUESTEDAPP, '?'));
$param = substr(self::$REQUESTEDAPP, strpos(self::$REQUESTEDAPP, '?') + 1);
--
GitLab