wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Properly check the data dir

Browse source 
* fixes #1364

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
This commit is contained in:
Morris Jobke 2016-12-05 17:09:23 +01:00
parent efa9ac1230
commit a2867c0664
No known key found for this signature in database
GPG key ID: 9CE5ED29E7FCD38A
3 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
core/js/setupchecks.js
View file

@ -198,7 +198,8 @@
}
var afterCall = function(xhr) {
var messages = [];
if (xhr.status !== 403 && xhr.status !== 307 && xhr.status !== 301 && xhr.responseText !== '') {
// .ocdata is an empty file in the data directory - if this is readable then the data dir is not protected
if (xhr.status === 200 && xhr.responseText === '') {
messages.push({
msg: t('core', 'Your data directory and your files are probably accessible from the Internet. The .htaccess file is not working. We strongly suggest that you configure your web server in a way that the data directory is no longer accessible or you move the data directory outside the web server document root.'),
type: OC.SetupChecks.MESSAGE_TYPE_ERROR
@ -209,7 +210,7 @@
$.ajax({
type: 'GET',
url: OC.linkTo('', oc_dataURL+'/htaccesstest.txt?t=' + (new Date()).getTime()),
url: OC.linkTo('', oc_dataURL+'/.ocdata?t=' + (new Date()).getTime()),
complete: afterCall,
allowAuthErrors: true
});

2
core/js/tests/specs/setupchecksSpec.js
View file

@ -103,7 +103,7 @@ describe('OC.SetupChecks tests', function() {
it('should return an error if data directory is not protected', function(done) {
var async = OC.SetupChecks.checkDataProtected();
suite.server.requests[0].respond(200, {'Content-Type': 'text/plain'}, 'file contents');
suite.server.requests[0].respond(200, {'Content-Type': 'text/plain'}, '');
async.done(function( data, s, x ){
expect(data).toEqual([

2
lib/private/legacy/util.php
View file

@ -1169,6 +1169,8 @@ class OC_Util {
}
fwrite($fp, $testContent);
fclose($fp);
return $testContent;
}
/**