From 047e68ecd40c1b98b4da66f5333d5517d89499e5 Mon Sep 17 00:00:00 2001 From: Ralf Becker Date: Wed, 11 Apr 2018 11:25:53 +0200 Subject: [PATCH] limit filesystem depth for managed attachments to gard against infinit recursion --- api/src/CalDAV.php | 1 + 1 file changed, 1 insertion(+) diff --git a/api/src/CalDAV.php b/api/src/CalDAV.php index d47f0f7530..e7bd3540d4 100644 --- a/api/src/CalDAV.php +++ b/api/src/CalDAV.php @@ -1543,6 +1543,7 @@ class CalDAV extends HTTP_WebDAV_Server foreach(Vfs::find(Link::vfs_path($app, $id, '', true), array( 'type' => 'F', 'need_mime' => true, + 'maxdepth' => 10, // set a limit to not run into an infinit recursion ), true) as $path => $stat) { // handle symlinks --> return target size and mime-type