[Pkg-owncloud-commits] [owncloud] 01/07: Backport SabreDAV LocalAssetPath fix

[David Prévot]

This is an automated email from the git hooks/post-receive script.

taffit pushed a commit to annotated tag v4.0.14
in repository owncloud.

commit 792c5ec13758a9bfd1e45c54ef30dce24bc787de
Author: Lukas Reschke <lukas at statuscode.ch>
Date:   Tue Apr 9 10:00:24 2013 +0200

    Backport SabreDAV LocalAssetPath fix
---
 3rdparty/Sabre/DAV/Browser/Plugin.php |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/3rdparty/Sabre/DAV/Browser/Plugin.php b/3rdparty/Sabre/DAV/Browser/Plugin.php
index 09bbdd2..b13c144 100644
--- a/3rdparty/Sabre/DAV/Browser/Plugin.php
+++ b/3rdparty/Sabre/DAV/Browser/Plugin.php
@@ -439,12 +439,16 @@ class Sabre_DAV_Browser_Plugin extends Sabre_DAV_ServerPlugin {
      */
     protected function getLocalAssetPath($assetName) {
 
+        $assetDir = realpath(__DIR__ . '/assets') . '/';
+        $path = $assetDir . $assetName;
+
         // Making sure people aren't trying to escape from the base path.
-        $assetSplit = explode('/', $assetName);
-        if (in_array('..',$assetSplit)) {
-            throw new Sabre_DAV_Exception('Incorrect asset path');
+        $path = realpath($path);
+
+        if ($path === false || substr($path, 0, strlen($assetDir))!==$assetDir) {
+            throw new Sabre_DAV_Exception_Forbidden('Path does not exist, or escaping from the base path was detected');
         }
-        $path = __DIR__ . '/assets/' . $assetName;
+
         return $path;
 
     }

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-owncloud/owncloud.git