Skip to content
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
escape all responses from server
  • Loading branch information
MorrisJobke committed Sep 22, 2016
commit 3411a98a8c8e678c0751f8a73ae1cbce6cc6c6f7
34 changes: 21 additions & 13 deletions index.php
Original file line number Diff line number Diff line change
Expand Up @@ -155,7 +155,7 @@ public function __construct() {
$configFileName = __DIR__ . '/../config/config.php';
}
if (!file_exists($configFileName)) {
throw new \Exception('Could not find '.__DIR__.'/../config.php. Is this file in the "updater" subfolder of Nextcloud?');
throw new \Exception('Could not find config.php. Is this file in the "updater" subfolder of Nextcloud?');
}

/** @var array $CONFIG */
Expand Down Expand Up @@ -371,6 +371,10 @@ public function setMaintenanceMode($state) {
}
$this->silentLog('[info] configFileName ' . $configFileName);

// usually is already tested in the constructor but just to be on the safe side
if (!file_exists($configFileName)) {
throw new \Exception('Could not find config.php.');
}
/** @var array $CONFIG */
require $configFileName;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add a check if the config file really exists, doesn't have to be the case with NEXTCLOUD_CONFIG_DIR.

$CONFIG['maintenance'] = $state;
Expand Down Expand Up @@ -1500,6 +1504,10 @@ public function logVersion() {
</body>
<?php if($auth->isAuthenticated()): ?>
<script>
function escapeHTML(s) {
return s.toString().split('&').join('&amp;').split('<').join('&lt;').split('>').join('&gt;').split('"').join('&quot;').split('\'').join('&#039;');
}

var done = false;
var started = false;
var updaterStepStart = parseInt(document.getElementById('updater-step-start').value);
Expand Down Expand Up @@ -1592,11 +1600,11 @@ function performStep(number, callback) {

var text = '';
if (typeof response['response'] === 'string') {
text = response['response'];
text = escapeHTML(response['response']);
} else {
text = 'The following extra files have been found:<ul>';
response['response'].forEach(function(file) {
text += '<li>' + file + '</li>';
text += '<li>' + escapeHTML(file) + '</li>';
});
text += '</ul>';
}
Expand All @@ -1613,11 +1621,11 @@ function performStep(number, callback) {

var text = '';
if (typeof response['response'] === 'string') {
text = response['response'];
text = escapeHTML(response['response']);
} else {
text = 'The following places can not be written to:<ul>';
response['response'].forEach(function(file) {
text += '<li>' + file + '</li>';
text += '<li>' + escapeHTML(file) + '</li>';
});
text += '</ul>';
}
Expand All @@ -1633,7 +1641,7 @@ function performStep(number, callback) {
errorStep('step-enable-maintenance');

if(response.response) {
addStepText('step-enable-maintenance', response.response);
addStepText('step-enable-maintenance', escapeHTML(response.response));
}
}
},
Expand All @@ -1646,7 +1654,7 @@ function performStep(number, callback) {
errorStep('step-backup');

if(response.response) {
addStepText('step-backup', response.response);
addStepText('step-backup', escapeHTML(response.response));
}
}
},
Expand All @@ -1659,7 +1667,7 @@ function performStep(number, callback) {
errorStep('step-download');

if(response.response) {
addStepText('step-download', response.response);
addStepText('step-download', escapeHTML(response.response));
}
}
},
Expand All @@ -1672,7 +1680,7 @@ function performStep(number, callback) {
errorStep('step-extract');

if(response.response) {
addStepText('step-extract', response.response);
addStepText('step-extract', escapeHTML(response.response));
}
}
},
Expand All @@ -1685,7 +1693,7 @@ function performStep(number, callback) {
errorStep('step-entrypoints');

if(response.response) {
addStepText('step-entrypoints', response.response);
addStepText('step-entrypoints', escapeHTML(response.response));
}
}
},
Expand All @@ -1698,7 +1706,7 @@ function performStep(number, callback) {
errorStep('step-delete');

if(response.response) {
addStepText('step-delete', response.response);
addStepText('step-delete', escapeHTML(response.response));
}
}
},
Expand All @@ -1715,7 +1723,7 @@ function performStep(number, callback) {
errorStep('step-move');

if(response.response) {
addStepText('step-move', response.response);
addStepText('step-move', escapeHTML(response.response));
}
}
},
Expand All @@ -1728,7 +1736,7 @@ function performStep(number, callback) {
errorStep('step-maintenance-mode');

if(response.response) {
addStepText('step-maintenance-mode', response.response);
addStepText('step-maintenance-mode', escapeHTML(response.response));
}
}
},
Expand Down