aboutsummaryrefslogtreecommitdiffstats
path: root/plugins/mod_http_file_share.lua
diff options
context:
space:
mode:
Diffstat (limited to 'plugins/mod_http_file_share.lua')
-rw-r--r--plugins/mod_http_file_share.lua6
1 files changed, 6 insertions, 0 deletions
diff --git a/plugins/mod_http_file_share.lua b/plugins/mod_http_file_share.lua
index 4c9dc9e9..89dda500 100644
--- a/plugins/mod_http_file_share.lua
+++ b/plugins/mod_http_file_share.lua
@@ -36,6 +36,7 @@ end
local upload_errors = errors.init(module.name, namespace, {
access = { "auth"; "forbidden" };
+ filename = { "modify"; "bad-request", "Invalid filename" };
});
function may_upload(uploader, filename, filesize, filetype) -- > boolean, error
@@ -44,6 +45,11 @@ function may_upload(uploader, filename, filesize, filetype) -- > boolean, error
return false, upload_errors.new("access");
end
+ if not filename or filename:find"/" then
+ -- On Linux, only '/' and '\0' are invalid in filenames and NUL can't be in XML
+ return false, upload_errors.new("filename");
+ end
+
return true;
end