harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix find_folder_hash_by_path() which was not safe against multiple attach structures with the same filename but in different directories

Browse Source
This commit is contained in:
zotlabs 2017-02-20 23:03:48 -08:00
parent 1c1d1f1185
commit e54ba7ecbc
2 changed files with 30 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Zotlabs/Storage/Browser.php
View File

@ -314,7 +314,13 @@ class Browser extends DAV\Browser\Plugin {
$quota['desc'] = $quotaDesc;
$quota['warning'] = ((($limit) && ((round($used / $limit, 1) * 100) >= 90)) ? t('WARNING:') : ''); // 10485760 bytes = 100MB
$path = trim(str_replace('cloud/' . $this->auth->owner_nick, '', $path), '/');
// strip 'cloud/nickname', but only at the beginning of the path
$special = 'cloud/' . $this->auth->owner_nick;
$count = strlen($special);
if(strpos($path,$special) === 0)
$path = trim(substr($path,$count),'/');
$output .= replace_macros(get_markup_template('cloud_actionspanel.tpl'), array(
'$folder_header' => t('Create new folder'),

32
include/attach.php
View File

@ -1477,20 +1477,34 @@ function find_folder_hash_by_attach_hash($channel_id, $attachHash, $recurse = fa
function find_folder_hash_by_path($channel_id, $path) {
$filename = end(explode('/', $path));
if(! $path)
return '';
if($filename) {
$r = q("SELECT hash FROM attach WHERE uid = %d AND filename = '%s' LIMIT 1",
$comps = explode('/',$path);
$errors = false;
$parent_hash = '';
for($x = 0; $x < count($comps); $x ++) {
$element = $comps[$x];
$r = q("SELECT hash FROM attach WHERE uid = %d AND filename = '%s' AND folder = '%s' LIMIT 1",
intval($channel_id),
dbesc($filename)
dbesc($element),
dbesc($parent_hash)
);
if($r) {
$parent_hash = $r[0]['hash'];
}
else {
$errors ++;
break;
}
}
$hash = '';
if($r && $r[0]['hash']) {
$hash = $r[0]['hash'];
}
return $hash;
if($errors)
return '';
return $parent_hash;
}
/**