upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-12 18:21:40 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 23

Merge pull request #25375 from owncloud/stable9-147c672f5866002d45ec68e99e379449792eeaf8

Browse source 
[stable9] Ignore invalid paths in the JS file list
This commit is contained in:
Vincent Petry 2016-07-06 18:18:17 +02:00 committed by GitHub
commit ad67b3f0b0
2 changed files with 39 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
apps/files/js/filelist.js
View file

@ -1327,6 +1327,16 @@
return OC.linkTo('files', 'index.php')+"?dir="+ encodeURIComponent(dir).replace(/%2F/g, '/');
},
_isValidPath: function(path) {
var sections = path.split('/');
for (var i = 0; i < sections.length; i++) {
if (sections[i] === '..') {
return false;
}
}
return true;
},
/**
* Sets the current directory name and updates the breadcrumb.
* @param targetDir directory to display
@ -1334,6 +1344,10 @@
*/
_setCurrentDir: function(targetDir, changeUrl) {
targetDir = targetDir.replace(/\\/g, '/');
if (!this._isValidPath(targetDir)) {
targetDir = '/';
changeUrl = true;
}
var previousDir = this.getCurrentDirectory(),
baseDir = OC.basename(targetDir);

25
apps/files/tests/js/filelistSpec.js
View file

@ -1323,6 +1323,31 @@ describe('OCA.Files.FileList tests', function() {
fileList.changeDirectory('/another\\subdir');
expect(fileList.getCurrentDirectory()).toEqual('/another/subdir');
});
it('switches to root dir when current directory is invalid', function() {
_.each([
'..',
'/..',
'../',
'/../',
'/../abc',
'/abc/..',
'/abc/../',
'/../abc/'
], function(path) {
fileList.changeDirectory(path);
expect(fileList.getCurrentDirectory()).toEqual('/');
});
});
it('allows paths with dotdot at the beginning or end', function() {
_.each([
'..abc',
'def..',
'...'
], function(path) {
fileList.changeDirectory(path);
expect(fileList.getCurrentDirectory()).toEqual(path);
});
});
it('switches to root dir when current directory does not exist', function() {
fileList.changeDirectory('/unexist');
deferredList.reject(404);