also prevent / as filename

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>
cs3org · Jun 25, 2024 · c857935 · c857935
1 parent 24ca4f8
commit c857935
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/internal/http/services/owncloud/ocdav/put.go b/internal/http/services/owncloud/ocdav/put.go
@@ -114,9 +114,9 @@ func (s *svc) handlePathPut(w http.ResponseWriter, r *http.Request, ns string) {
 
 	fn := path.Join(ns, r.URL.Path)
 
-	sublog := appctx.GetLogger(ctx).With().Str("path", fn).Logger()
+	sublog := appctx.GetLogger(ctx).With().Str("path", r.URL.Path).Logger()
 
-	if err := ValidateName(filepath.Base(fn), s.nameValidators); err != nil {
+	if err := ValidateName(filepath.Base(r.URL.Path), s.nameValidators); err != nil {
 		w.WriteHeader(http.StatusBadRequest)
 		b, err := errors.Marshal(http.StatusBadRequest, err.Error(), "")
 		errors.HandleWebdavError(&sublog, w, b, err)

diff --git a/internal/http/services/owncloud/ocdav/validation.go b/internal/http/services/owncloud/ocdav/validation.go
@@ -42,7 +42,7 @@ func ValidateDestination(name string, validators []Validator) error {
 
 func notReserved() Validator {
 	return func(s string) error {
-		if s == ".." || s == "." {
+		if s == ".." || s == "." || s == "/" {
 			return errors.New(". and .. are reserved names")
 		}
 		return nil