upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-09 08:44:07 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

safer URL match in FileReferenceProvider

Browse source 
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
This commit is contained in:
Julien Veyssier 2023-02-09 14:33:19 +01:00
parent 2c05c2479e
commit 4ef2b27a47
No known key found for this signature in database
GPG key ID: 4141FEE162030638
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
lib/private/Collaboration/Reference/File/FileReferenceProvider.php
View file

@ -62,21 +62,21 @@ class FileReferenceProvider implements IReferenceProvider {
}
private function getFilesAppLinkId(string $referenceText): ?int {
$start = $this->urlGenerator->getAbsoluteURL('/apps/files');
$startIndex = $this->urlGenerator->getAbsoluteURL('/index.php/apps/files');
$start = $this->urlGenerator->getAbsoluteURL('/apps/files/');
$startIndex = $this->urlGenerator->getAbsoluteURL('/index.php/apps/files/');
$fileId = null;
if (mb_strpos($referenceText, $start) === 0) {
$parts = parse_url($referenceText);
parse_str($parts['query'], $query);
parse_str($parts['query'] ?? '', $query);
$fileId = isset($query['fileid']) ? (int)$query['fileid'] : $fileId;
$fileId = isset($query['openfile']) ? (int)$query['openfile'] : $fileId;
}
if (mb_strpos($referenceText, $startIndex) === 0) {
$parts = parse_url($referenceText);
parse_str($parts['query'], $query);
parse_str($parts['query'] ?? '', $query);
$fileId = isset($query['fileid']) ? (int)$query['fileid'] : $fileId;
$fileId = isset($query['openfile']) ? (int)$query['openfile'] : $fileId;
}