Plugin: OnlyOffice: Fix filtering in document creation

plugin/onlyoffice/create.php

@@ -26,28 +26,32 @@ $mapFileFormat = [
     "presentation" => $plugin->get_lang("presentation"),
 ];
 
-$userId = $_GET["userId"];
-$sessionId = $_GET["sessionId"];
-$docId = $_GET["folderId"];
-$courseId = $_GET["courseId"];
+$userId = !empty($_GET["userId"])? $_GET['userId'] : 0;
+$sessionId = !empty($_GET["sessionId"])? $_GET["sessionId"] :0;
+$docId = !empty($_GET["folderId"])? $_GET["folderId"] :0;
+$courseId = !empty($_GET["courseId"])? $_GET["courseId"] :0;
+$groupId = !empty($_GET["groupId"])? $_GET["groupId"] :0;
+$folderId = !empty($_GET["folderId"])? $_GET["folderId"] :0;
 
 $courseInfo = api_get_course_info_by_id($courseId);
 $courseCode = $courseInfo["code"];
 
-$docInfo = DocumentManager::get_document_data_by_id(
+$isMyDir = false;
+if (!empty($docId)) {
+    $docInfo = DocumentManager::get_document_data_by_id(
         $docId,
         $courseCode,
         true,
         $sessionId
-);
-
-$groupRights = Session::read('group_member_with_upload_rights');
-$isAllowToEdit = api_is_allowed_to_edit(true, true);
-$isMyDir = DocumentManager::is_my_shared_folder(
+    );
+    $isMyDir = DocumentManager::is_my_shared_folder(
         $userId,
         $docInfo["absolute_path"],
         $sessionId
-);
+    );
+}
+$groupRights = Session::read('group_member_with_upload_rights');
+$isAllowToEdit = api_is_allowed_to_edit(true, true);
 if (!($isAllowToEdit || $isMyDir || $groupRights)) {
     api_not_allowed(true);
 }
@@ -62,11 +66,11 @@ $form->addText("fileName", $plugin->get_lang("title"), true);
 $form->addSelect("fileFormat", $plugin->get_lang("chooseFileFormat"), $mapFileFormat);
 $form->addButtonCreate($plugin->get_lang("create"));
 
-$form->addHidden("groupId", (int) $_GET["groupId"]);
-$form->addHidden("courseId", (int) $_GET["courseId"]);
-$form->addHidden("sessionId", (int) $_GET["sessionId"]);
-$form->addHidden("userId", (int) $_GET["userId"]);
-$form->addHidden("folderId", (int) $_GET["folderId"]);
+$form->addHidden("groupId", $groupId);
+$form->addHidden("courseId", $courseId);
+$form->addHidden("sessionId", $sessionId);
+$form->addHidden("userId", $userId);
+$form->addHidden("folderId", $folderId);
 $form->addHidden("goBackUrl", Security::remove_XSS($_SERVER["HTTP_REFERER"]));
 
 if ($form->validate()) {
@@ -81,14 +85,13 @@ if ($form->validate()) {
 
     $fileType = $values["fileFormat"];
     $fileExt = FileUtility::getDocExt($fileType);
-    $fileTitle = $values["fileName"].".".$fileExt;
+    $fileTitle = Security::remove_XSS($values["fileName"]).".".$fileExt;
 
     $courseInfo = api_get_course_info_by_id($courseId);
     $courseCode = $courseInfo["code"];
 
     $fileNamePrefix = DocumentManager::getDocumentSuffix($courseInfo, $sessionId, $groupId);
-    $fileName = $values["fileName"].$fileNamePrefix.".".$fileExt;
-
+    $fileName = preg_replace('/\.\./', '', $values["fileName"]).$fileNamePrefix.".".$fileExt;
     $groupInfo = GroupManager::get_group_properties($groupId);
 
     $emptyTemplatePath = TemplateManager::getEmptyTemplate($fileExt);
@@ -118,7 +121,7 @@ if ($form->validate()) {
         Display::addFlash(Display::return_message($plugin->get_lang("fileIsExist"), "error"));
         goto display;
     }
-    if (!Security::check_abs_path($filePath, $folderPath)) {
+    if (!Security::check_abs_path($folderPath, $folderPath)) {
         Display::addFlash(Display::return_message(get_lang('SendFileError'), 'error'));
         goto display;
     }