Remove invalid characters from app id to prevent loading of invalid resources

core/ajax/translations.php

@@ -22,6 +22,7 @@
 */
 
 $app = $_POST["app"];
+$app = OC_App::cleanAppId($app);
 
 $l = OC_L10N::get( $app );
 

lib/app.php

@@ -38,6 +38,15 @@ class OC_App{
 	static private $checkedApps = array();
 	static private $altLogin = array();
 
+	/**
+	 * @brief clean the appid
+	 * @param $app Appid that needs to be cleaned
+	 * @return string
+	 */
+	public static function cleanAppId($app) {
+		return str_replace(array('\0', '/', '\\', '..'), '', $app);
+	}
+
 	/**
 	 * @brief loads all apps
 	 * @param array $types

lib/base.php

@@ -468,7 +468,7 @@ class OC {
 		register_shutdown_function(array('OC_Helper', 'cleanTmp'));
 
 		//parse the given parameters
-		self::$REQUESTEDAPP = (isset($_GET['app']) && trim($_GET['app']) != '' && !is_null($_GET['app']) ? str_replace(array('\0', '/', '\\', '..'), '', strip_tags($_GET['app'])) : OC_Config::getValue('defaultapp', 'files'));
+		self::$REQUESTEDAPP = (isset($_GET['app']) && trim($_GET['app']) != '' && !is_null($_GET['app']) ? OC_App::cleanAppId(strip_tags($_GET['app'])) : OC_Config::getValue('defaultapp', 'files'));
 		if (substr_count(self::$REQUESTEDAPP, '?') != 0) {
 			$app = substr(self::$REQUESTEDAPP, 0, strpos(self::$REQUESTEDAPP, '?'));
 			$param = substr($_GET['app'], strpos($_GET['app'], '?') + 1);

lib/l10n.php

@@ -97,7 +97,7 @@ class OC_L10N{
 		if ($this->app === true) {
 			return;
 		}
-		$app = $this->app;
+		$app = OC_App::cleanAppId($this->app);
 		$lang = $this->lang;
 		$this->app = true;
 		// Find the right language

settings/ajax/disableapp.php

@@ -2,6 +2,6 @@
 OC_JSON::checkAdminUser();
 OCP\JSON::callCheck();
 
-OC_App::disable($_POST['appid']);
+OC_App::disable(OC_App::cleanAppId($_POST['appid']));
 
 OC_JSON::success();

settings/ajax/enableapp.php

@@ -3,7 +3,7 @@
 OC_JSON::checkAdminUser();
 OCP\JSON::callCheck();
 
-$appid = OC_App::enable($_POST['appid']);
+$appid = OC_App::enable(OC_App::cleanAppId($_POST['appid']));
 if($appid !== false) {
 	OC_JSON::success(array('data' => array('appid' => $appid)));
 } else {

settings/ajax/navigationdetect.php

@@ -4,6 +4,7 @@ OC_Util::checkAdminUser();
 OCP\JSON::callCheck();
 
 $app = $_GET['app'];
+$app = OC_App::cleanAppId($app);
 
 //load the one app and see what it adds to the navigation
 OC_App::loadApp($app);

settings/ajax/updateapp.php

@@ -4,6 +4,7 @@ OC_JSON::checkAdminUser();
 OCP\JSON::callCheck();
 
 $appid = $_POST['appid'];
+$appid = OC_App::cleanAppId($appid);
 
 $result = OC_Installer::updateApp($appid);
 if($result !== false) {