[Pkg-owncloud-commits] [owncloud] 12/63: escape like parameter in cache move

[David Prévot]

This is an automated email from the git hooks/post-receive script.

taffit pushed a commit to branch stable8.0
in repository owncloud.

commit 08866d54fda7e8ca07286fe565ff12762f726375
Author: Robin Appelman <icewind at owncloud.com>
Date:   Tue Nov 10 13:14:32 2015 +0100

    escape like parameter in cache move
---
 lib/private/files/cache/cache.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/private/files/cache/cache.php b/lib/private/files/cache/cache.php
index 358e654..b6062c7 100644
--- a/lib/private/files/cache/cache.php
+++ b/lib/private/files/cache/cache.php
@@ -432,7 +432,8 @@ class Cache {
 		if ($sourceData['mimetype'] === 'httpd/unix-directory') {
 			//find all child entries
 			$sql = 'SELECT `path`, `fileid` FROM `*PREFIX*filecache` WHERE `storage` = ? AND `path` LIKE ?';
-			$result = \OC_DB::executeAudited($sql, array($this->getNumericStorageId(), $source . '/%'));
+			$escapedsource = addcslashes($source, '\\_%');
+			$result = \OC_DB::executeAudited($sql, array($this->getNumericStorageId(), $escapedsource . '/%'));
 			$childEntries = $result->fetchAll();
 			$sourceLength = strlen($source);
 			$query = \OC_DB::prepare('UPDATE `*PREFIX*filecache` SET `path` = ?, `path_hash` = ? WHERE `fileid` = ?');

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-owncloud/owncloud.git