fix: Allow read-only filename validation to allow reading files

Needed to read files with the "Windows compatibility" feature.

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
pull/47185/head
Ferdinand Thiessen 2 years ago committed by Andy Scherzinger
parent 030c209d22
commit 08836696e2
  1. 2
      apps/dav/lib/Connector/Sabre/Directory.php
  2. 13
      lib/private/Files/View.php

@ -173,7 +173,7 @@ class Directory extends \OCA\DAV\Connector\Sabre\Node implements \Sabre\DAV\ICol
$path = $this->path . '/' . $name;
if (is_null($info)) {
try {
$this->fileView->verifyPath($this->path, $name);
$this->fileView->verifyPath($this->path, $name, true);
$info = $this->fileView->getFileInfo($path);
} catch (\OCP\Files\StorageNotAvailableException $e) {
throw new \Sabre\DAV\Exception\ServiceUnavailable($e->getMessage(), 0, $e);

@ -1826,15 +1826,26 @@ class View {
/**
* @param string $path
* @param string $fileName
* @param bool $readonly Check only if the path is allowed for read-only access
* @throws InvalidPathException
*/
public function verifyPath($path, $fileName): void {
public function verifyPath($path, $fileName, $readonly = false): void {
// All of the view's functions disallow '..' in the path so we can short cut if the path is invalid
if (!Filesystem::isValidPath($path ?: '/')) {
$l = \OCP\Util::getL10N('lib');
throw new InvalidPathException($l->t('Path contains invalid segments'));
}
// Short cut for read-only validation
if ($readonly) {
$validator = \OCP\Server::get(FilenameValidator::class);
if ($validator->isForbidden($fileName)) {
$l = \OCP\Util::getL10N('lib');
throw new InvalidPathException($l->t('Filename is a reserved word'));
}
return;
}
try {
/** @type \OCP\Files\Storage $storage */
[$storage, $internalPath] = $this->resolvePath($path);

Loading…
Cancel
Save