[Pkg-owncloud-commits] [owncloud] 01/02: Fix Information exposure through directory listing [CVE-2015-6500]

[David Prévot]

This is an automated email from the git hooks/post-receive script.

taffit pushed a commit to branch master
in repository owncloud.

commit 976811e26ff62507139117baac07d72a8ce65e35
Author: David Prévot <taffit at debian.org>
Date:   Sun Sep 27 12:14:47 2015 -0400

    Fix Information exposure through directory listing [CVE-2015-6500]
    
    Closes: #800126
---
 ...f-the-user-is-trying-to-scan-a-valid-path.patch | 24 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 2 files changed, 25 insertions(+)

diff --git a/debian/patches/0011-check-if-the-user-is-trying-to-scan-a-valid-path.patch b/debian/patches/0011-check-if-the-user-is-trying-to-scan-a-valid-path.patch
new file mode 100644
index 0000000..b9d9091
--- /dev/null
+++ b/debian/patches/0011-check-if-the-user-is-trying-to-scan-a-valid-path.patch
@@ -0,0 +1,24 @@
+From: Robin Appelman <icewind at owncloud.com>
+Date: Sun, 26 Jul 2015 19:13:31 +0200
+Subject: check if the user is trying to scan a valid path
+
+Origin: upstream, https://github.com/owncloud/core/commit/9f8c0a3a8d14f1c127b2034faa14d8d309f962e9
+Bug-Debian: https://bugs.debian.org/800126
+---
+ lib/private/files/utils/scanner.php | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/lib/private/files/utils/scanner.php b/lib/private/files/utils/scanner.php
+index c2fabf5..15024b5 100644
+--- a/lib/private/files/utils/scanner.php
++++ b/lib/private/files/utils/scanner.php
+@@ -108,6 +108,9 @@ class Scanner extends PublicEmitter {
+ 	 * @throws \OC\ForbiddenException
+ 	 */
+ 	public function scan($dir) {
++		if (!Filesystem::isValidPath($dir)) {
++			throw new \InvalidArgumentException('Invalid path to scan');
++		}
+ 		$mounts = $this->getMounts($dir);
+ 		foreach ($mounts as $mount) {
+ 			if (is_null($mount->getStorage())) {
diff --git a/debian/patches/series b/debian/patches/series
index 708b59e..6cd84a2 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -8,3 +8,4 @@ path/0007-Adapt-aws-sdk-path.patch
 path/0008-Adapt-google-api-php-client-path.patch
 path/0009-Adapt-Dropbox-path.patch
 0010-Replace-_method-requirement-by-g-s-etMethods.patch
+0011-check-if-the-user-is-trying-to-scan-a-valid-path.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-owncloud/owncloud.git