nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-08-21 17:06:22 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Don't allow a / in the UID to infect the path on import.

Browse Source
This commit is contained in:
Andrew McMillan 2011-11-09 09:55:57 +13:00
parent f7420b1a9b
commit 54e89d407b
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
inc/caldav-PUT-functions.php
View File

@ -648,7 +648,8 @@ EOSQL;
$dav_data_params = $base_params;
$dav_data_params[':user_no'] = $user_no;
$dav_data_params[':dav_name'] = sprintf( '%s%s.ics', $path, $uid );
// We don't allow a '/' in the UID to appear in the path, but anything else is fair game.
$dav_data_params[':dav_name'] = sprintf( '%s%s.ics', $path, str_replace('/','',$uid) );
$dav_data_params[':etag'] = md5($icalendar);
$calitem_params = $dav_data_params;
$dav_data_params[':dav_data'] = $icalendar;