diff --git a/apps/files/js/files.js b/apps/files/js/files.js index 99f888ce0f71d6a671a553860a53ea1b97b564b7..5b345a45b67d3611e7f6c92955aad840b4a26d85 100644 --- a/apps/files/js/files.js +++ b/apps/files/js/files.js @@ -101,7 +101,10 @@ throw t('files', '"{name}" is an invalid file name.', {name: name}); } else if (trimmedName.length === 0) { throw t('files', 'File name cannot be empty.'); + } else if (OC.fileIsBlacklisted(trimmedName)) { + throw t('files', '"{name}" is not an allowed filetype', {name: name}); } + return true; }, displayStorageWarnings: function() { diff --git a/apps/files/tests/js/filesSpec.js b/apps/files/tests/js/filesSpec.js index b7627d59fdf66945b32531bcaf333b4c097a6c3e..5c3f68b2ba4748ea0c992624d32c1cbb508e3c30 100644 --- a/apps/files/tests/js/filesSpec.js +++ b/apps/files/tests/js/filesSpec.js @@ -58,7 +58,9 @@ describe('OCA.Files.Files tests', function() { ' ..', '.. ', '. ', - ' .' + ' .', + 'foo.part', + 'bar.filepart' ]; for ( var i = 0; i < fileNames.length; i++ ) { var threwException = false; diff --git a/core/js/js.js b/core/js/js.js index 5c737d41793becdf58544b10baf2913d7036a2a8..8c6fc0d9c07cdf6f520f36d4c395e95381f2673a 100644 --- a/core/js/js.js +++ b/core/js/js.js @@ -224,6 +224,14 @@ var OCP = {}, return link; }, + /** + * Check if a user file is allowed to be handled. + * @param {string} file to check + */ + fileIsBlacklisted: function(file) { + return !!(file.match(oc_config.blacklist_files_regex)); + }, + /** * Redirect to the target URL, can also be used for downloads. * @param {string} targetURL URL to redirect to diff --git a/core/js/tests/specHelper.js b/core/js/tests/specHelper.js index 7897a2f2842c835dd551c84d3897258e406a1efe..a411ade7dea2cf8a2e36b2c9167745fd138c9868 100644 --- a/core/js/tests/specHelper.js +++ b/core/js/tests/specHelper.js @@ -94,7 +94,8 @@ window.oc_appswebroots = { }; window.oc_config = { session_lifetime: 600 * 1000, - session_keepalive: false + session_keepalive: false, + blacklist_files_regex: '\.(part|filepart)$', }; window.oc_appconfig = { core: {} diff --git a/lib/private/Template/JSConfigHelper.php b/lib/private/Template/JSConfigHelper.php index 6bf08dcdada81093465554b290960895fe2d7549..ca45bbee9c62b417c8bec404dc07bbc4839574a5 100644 --- a/lib/private/Template/JSConfigHelper.php +++ b/lib/private/Template/JSConfigHelper.php @@ -209,6 +209,7 @@ class JSConfigHelper { 'modRewriteWorking' => ($this->config->getSystemValue('htaccess.IgnoreFrontController', false) === true || getenv('front_controller_active') === 'true'), 'sharing.maxAutocompleteResults' => intval($this->config->getSystemValue('sharing.maxAutocompleteResults', 0)), 'sharing.minSearchStringLength' => intval($this->config->getSystemValue('sharing.minSearchStringLength', 0)), + 'blacklist_files_regex' => \OCP\Files\FileInfo::BLACKLIST_FILES_REGEX, ]), "oc_appconfig" => json_encode([ 'core' => [ diff --git a/lib/public/Files/FileInfo.php b/lib/public/Files/FileInfo.php index b6718efba34907f771e6d509f73f563d8cdef5c1..8eeb8df08ce0fe936f0c2ce820128961f3020890 100644 --- a/lib/public/Files/FileInfo.php +++ b/lib/public/Files/FileInfo.php @@ -63,6 +63,12 @@ interface FileInfo { */ const MIMETYPE_FOLDER = 'httpd/unix-directory'; + /** + * @const \OCP\Files\FileInfo::BLACKLIST_FILES_REGEX Return regular expression to test filenames against (blacklisting) + * @since 12.0.0 + */ + const BLACKLIST_FILES_REGEX = '\.(part|filepart)$'; + /** * Get the Etag of the file or folder *