From f4136854b6e8ccf88e3e0de3ff1202845be8f903 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Schie=C3=9Fle?= <schiessle@owncloud.com>
Date: Fri, 5 Oct 2012 11:15:32 +0200
Subject: [PATCH] stripsplashes doesn't work if the slash is the only character
-> creating file in root dir leads to "//filename"
---
apps/files/ajax/newfile.php | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/apps/files/ajax/newfile.php b/apps/files/ajax/newfile.php
index c2d65d718c..77d866979c 100644
--- a/apps/files/ajax/newfile.php
+++ b/apps/files/ajax/newfile.php
@@ -8,12 +8,11 @@ if(!OC_User::isLoggedIn()) {
}
session_write_close();
-
// Get the params
-$dir = isset( $_REQUEST['dir'] ) ? stripslashes($_REQUEST['dir']) : '';
-$filename = isset( $_REQUEST['filename'] ) ? stripslashes($_REQUEST['filename']) : '';
+$dir = isset( $_REQUEST['dir'] ) ? trim($_REQUEST['dir'], '/\\') : '';
+$filename = isset( $_REQUEST['filename'] ) ? trim($_REQUEST['filename'], '/\\') : '';
$content = isset( $_REQUEST['content'] ) ? $_REQUEST['content'] : '';
-$source = isset( $_REQUEST['source'] ) ? stripslashes($_REQUEST['source']) : '';
+$source = isset( $_REQUEST['source'] ) ? trim($_REQUEST['source'], '/\\') : '';
if($source) {
$eventSource=new OC_EventSource();
--
GitLab