Skip to content

fix(theming): reject invalid image paths - #66018

Open
susnux wants to merge 2 commits into
masterfrom
fix/theming-cache-cleanup
Open

susnux wants to merge 2 commits into
masterfrom
fix/theming-cache-cleanup

Conversation

@susnux

@susnux susnux commented Oct 29, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Smaller issues found while I was working on an other theming related issue.

Checklist

AI (if applicable)

  • The content of this PR was partly or fully generated using AI

Since the theming app data was scoped into the "global" folder,
`ImageManager::cleanup()` listed the cache-buster folders through
`ISimpleFolder::getDirectoryListing()`, which only returns files. So
outdated cache folders were never removed.

Add `ISimpleFolder::getFolderListing()` to list the sub folders of a
simple folder and use it for the cleanup.

Assisted-by: ClaudeCode:claude-opus-5-5
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
`Util::getAppImage()` removed `..` and backslashes from the requested
path and additionally tried the path with several image extensions
appended. So many different paths resolved to the same file.

Reject such paths instead and only resolve the exact path.

Assisted-by: ClaudeCode:claude-opus-5-5
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
@susnux
susnux requested a review from a team as a code owner October 29, 2026 16:54
@susnux
susnux requested review from come-nc, icewind1991, leftybournes and sorbaugh and removed request for a team October 29, 2026 16:54
@susnux susnux added this to the Nextcloud 36 milestone Oct 29, 2026
@susnux
susnux requested review from skjnldsv and removed request for sorbaugh October 29, 2026 16:55
* @return ISimpleFolder[]
* @since 36.0.0
*/
public function getFolderListing(): array;

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure we really want to have this here, I felt like its easier to have it in the interface then always do this in application code.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants