[Pkg-owncloud-commits] [owncloud] 27/86: escape like parameter in cache move

[David Prévot]

This is an automated email from the git hooks/post-receive script.

taffit pushed a commit to annotated tag v8.1.5
in repository owncloud.

commit 9d04876824e3807866ea519a4302fe2c50bf2254
Author: Robin Appelman <icewind at owncloud.com>
Date:   Tue Nov 10 13:14:32 2015 +0100

    escape like parameter in cache move
---
 lib/private/files/cache/cache.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/private/files/cache/cache.php b/lib/private/files/cache/cache.php
index 680398e..7cdff3a 100644
--- a/lib/private/files/cache/cache.php
+++ b/lib/private/files/cache/cache.php
@@ -544,7 +544,8 @@ class Cache {
 		if ($sourceData['mimetype'] === 'httpd/unix-directory') {
 			//find all child entries
 			$sql = 'SELECT `path`, `fileid` FROM `*PREFIX*filecache` WHERE `storage` = ? AND `path` LIKE ?';
-			$result = \OC_DB::executeAudited($sql, [$sourceStorageId, $sourcePath . '/%']);
+			$escapedPath = addcslashes($sourcePath, '\\_%');
+			$result = \OC_DB::executeAudited($sql, [$sourceStorageId, $escapedPath . '/%']);
 			$childEntries = $result->fetchAll();
 			$sourceLength = strlen($sourcePath);
 			\OC_DB::beginTransaction();

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-owncloud/owncloud.git