From 54e89d407b83201039074c026d2e61e41bd9210a Mon Sep 17 00:00:00 2001 From: Andrew McMillan Date: Wed, 9 Nov 2011 09:55:57 +1300 Subject: [PATCH] Don't allow a / in the UID to infect the path on import. --- inc/caldav-PUT-functions.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/inc/caldav-PUT-functions.php b/inc/caldav-PUT-functions.php index f1fb9374..d4c5025e 100644 --- a/inc/caldav-PUT-functions.php +++ b/inc/caldav-PUT-functions.php @@ -648,7 +648,8 @@ EOSQL; $dav_data_params = $base_params; $dav_data_params[':user_no'] = $user_no; - $dav_data_params[':dav_name'] = sprintf( '%s%s.ics', $path, $uid ); + // We don't allow a '/' in the UID to appear in the path, but anything else is fair game. + $dav_data_params[':dav_name'] = sprintf( '%s%s.ics', $path, str_replace('/','',$uid) ); $dav_data_params[':etag'] = md5($icalendar); $calitem_params = $dav_data_params; $dav_data_params[':dav_data'] = $icalendar;