Skip to content

Commit

Permalink
Don't disclose relative directory path for single shared files of user
Browse files Browse the repository at this point in the history
The "dir" key is used within the public sharing template to indicate in which directory the user currently is when sharing a directory with subdirectories. This is needed by the JS scripts.

However, when not accessing a directory then "dir" was set to the relative path of the file (from the user's home directory), meaning that for every public shared file the sharee can see the path.
(For example if you share the file "foo.txt" from "finances/topsecret/" the sharee would still see the path "finances/topsecret/" from the shared HTML template)

This is not the excpected behaviour and can be considered a privacy problem, this patch addresses this by setting "dir" to an empty key.
  • Loading branch information
LukasReschke authored and MorrisJobke committed Nov 18, 2014
1 parent 5f07fb1 commit f3ab4f3
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 2 deletions.
2 changes: 1 addition & 1 deletion apps/files_sharing/lib/controllers/sharecontroller.php
Original file line number Diff line number Diff line change
Expand Up @@ -172,7 +172,7 @@ public function showShare($token, $path = '') {
$shareTmpl['sharingToken'] = $token;
$shareTmpl['server2serversharing'] = Helper::isOutgoingServer2serverShareEnabled();
$shareTmpl['protected'] = isset($linkItem['share_with']) ? 'true' : 'false';
$shareTmpl['dir'] = $dir;
$shareTmpl['dir'] = '';
$shareTmpl['fileSize'] = \OCP\Util::humanFileSize(\OC\Files\Filesystem::filesize($originalSharePath));

// Show file list
Expand Down
2 changes: 1 addition & 1 deletion apps/files_sharing/tests/controller/sharecontroller.php
Original file line number Diff line number Diff line change
Expand Up @@ -153,7 +153,7 @@ public function testShowShare() {
'sharingToken' => $this->token,
'server2serversharing' => true,
'protected' => 'true',
'dir' => '/',
'dir' => '',
'downloadURL' => null,
'fileSize' => '33 B'
);
Expand Down

0 comments on commit f3ab4f3

Please sign in to comment.