upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-06 23:34:22 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 33

fix: add some recrusive detection/prevention

Browse source 
Signed-off-by: Robin Appelman <robin@icewind.nl>
This commit is contained in:
Robin Appelman 2023-08-21 19:45:03 +02:00
parent 32ea6058ba
commit 7d98e83e3f
No known key found for this signature in database
GPG key ID: 42B69D8A64526EFB
2 changed files with 25 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
apps/files_sharing/lib/SharedStorage.php
View file

@ -40,6 +40,7 @@ use OC\Files\Storage\Common;
use OC\Files\Storage\FailedStorage;
use OC\Files\Storage\Home;
use OC\Files\Storage\Wrapper\PermissionsMask;
use OC\Files\Storage\Wrapper\Wrapper;
use OC\User\DisplayNameCache;
use OC\User\NoUserException;
use OCA\Files_External\Config\ExternalMountPoint;
@ -96,6 +97,8 @@ class SharedStorage extends \OC\Files\Storage\Wrapper\Jail implements ISharedSto
private string $sourcePath = '';
private static int $initDepth = 0;
public function __construct($arguments) {
$this->ownerView = $arguments['ownerView'];
$this->logger = \OC::$server->get(LoggerInterface::class);
@ -135,8 +138,15 @@ class SharedStorage extends \OC\Files\Storage\Wrapper\Jail implements ISharedSto
if ($this->initialized) {
return;
}
$this->initialized = true;
self::$initDepth++;
try {
if (self::$initDepth > 10) {
throw new \Exception("Maximum share depth reached");
}
/** @var IRootFolder $rootFolder */
$rootFolder = \OC::$server->get(IRootFolder::class);
$this->ownerUserFolder = $rootFolder->getUserFolder($this->superShare->getShareOwner());
@ -149,6 +159,9 @@ class SharedStorage extends \OC\Files\Storage\Wrapper\Jail implements ISharedSto
$this->cache = new FailedCache();
$this->rootPath = '';
} else {
if ($this->nonMaskedStorage instanceof Wrapper && $this->nonMaskedStorage->isWrapperOf($this)) {
throw new \Exception('recursive share detected');
}
$this->nonMaskedStorage = $ownerNode->getStorage();
$this->sourcePath = $ownerNode->getPath();
$this->rootPath = $ownerNode->getInternalPath();
@ -177,6 +190,7 @@ class SharedStorage extends \OC\Files\Storage\Wrapper\Jail implements ISharedSto
if (!$this->nonMaskedStorage) {
$this->nonMaskedStorage = $this->storage;
}
self::$initDepth--;
}
/**

11
lib/private/Files/Storage/Wrapper/Wrapper.php
View file

@ -654,4 +654,15 @@ class Wrapper implements \OC\Files\Storage\Storage, ILockingStorage, IWriteStrea
public function getDirectoryContent($directory): \Traversable {
return $this->getWrapperStorage()->getDirectoryContent($directory);
}
public function isWrapperOf(IStorage $storage) {
$wrapped = $this->getWrapperStorage();
if ($wrapped === $storage) {
return true;
}
if ($wrapped instanceof Wrapper) {
return $wrapped->isWrapperOf($storage);
}
return false;
}
}