[Pkg-owncloud-commits] [owncloud] 53/69: escape like parameter in cache move

[David Prévot]

This is an automated email from the git hooks/post-receive script.

taffit pushed a commit to branch stable8
in repository owncloud.

commit 0b9b91fc607e068a712794881a5c505138d07ebe
Author: Robin Appelman <icewind at owncloud.com>
Date:   Tue Nov 10 13:14:32 2015 +0100

    escape like parameter in cache move
---
 lib/private/files/cache/cache.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/private/files/cache/cache.php b/lib/private/files/cache/cache.php
index e4e3522..7ef11d1 100644
--- a/lib/private/files/cache/cache.php
+++ b/lib/private/files/cache/cache.php
@@ -483,7 +483,8 @@ class Cache {
 		if ($sourceData['mimetype'] === 'httpd/unix-directory') {
 			//find all child entries
 			$sql = 'SELECT `path`, `fileid` FROM `*PREFIX*filecache` WHERE `storage` = ? AND `path` LIKE ?';
-			$result = \OC_DB::executeAudited($sql, [$sourceStorageId, $sourcePath . '/%']);
+			$escapedPath = addcslashes($sourcePath, '\\_%');
+			$result = \OC_DB::executeAudited($sql, [$sourceStorageId, $escapedPath . '/%']);
 			$childEntries = $result->fetchAll();
 			$sourceLength = strlen($sourcePath);
 			\OC_DB::beginTransaction();

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-owncloud/owncloud.git