diff --git a/plugin/onlyoffice/lib/onlyofficeDocumentManager.php b/plugin/onlyoffice/lib/onlyofficeDocumentManager.php index 0ac7bca4cb..a051dc0efc 100644 --- a/plugin/onlyoffice/lib/onlyofficeDocumentManager.php +++ b/plugin/onlyoffice/lib/onlyofficeDocumentManager.php @@ -189,8 +189,11 @@ class OnlyofficeDocumentManager extends DocumentManager $fileTitle = Security::remove_XSS($basename).'.'.$fileExt; - $fileNamePrefix = ChamiloDocumentManager::getDocumentSuffix($courseInfo, $sessionId, $groupId); - $fileName = preg_replace('/\.\./', '', $basename).$fileNamePrefix.'.'.$fileExt; + $fileNameSuffix = ChamiloDocumentManager::getDocumentSuffix($courseInfo, $sessionId, $groupId); + // Try to avoid directories browsing (remove .., slashes and backslashes) + $patterns = ['#\.\./#', '#\.\.#', '#/#', '#\\\#']; + $replacements = ['', '', '', '']; + $fileName = preg_replace($patterns, $replacements, $basename).$fileNameSuffix.'.'.$fileExt; if (empty($templatePath)) { $templatePath = TemplateManager::getEmptyTemplate($fileExt);