Re: Possible data loss or data modification in ownCloud

[Simon McVittie <smcv () debian org>]

On 10/08/12 10:25, Bruno Kleinert wrote:
> if ($source) { +               switch ($mode) { +
> case 'r+': +                       case 'rb+': ... +
> case 'a': +                       case 'ab': +
> if (!$this->is_writable($path)) { +
> return false; +                               }

I find this suspicious. Surely this should be enumerating the modes
that are safe, rather than the modes that are not safe? With that
patch, if a new value for $mode is added, it's assumed to be a read
operation. It seems much safer to assume that unknown modes are writes:

    switch ($mode) {
        case 'r':
        case 'rb':
            break;
        default:
            if (!$this->is_writable($path)) {
                return false;
            }
    }

Regards,
    S