Merge pull request #895 from bareos/dev/fbergkemper/bareos-19.2/backp…

…ort-971-1020 webui: backport to fix issue #971 and issue #1020
bareos · Jul 22, 2021 · a3873fe · a3873fe
2 parents 384dc67 + 64692fd
commit a3873fe
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 4 deletions.
diff --git a/webui/module/Restore/src/Restore/Controller/RestoreController.php b/webui/module/Restore/src/Restore/Controller/RestoreController.php
@@ -5,7 +5,7 @@
  * bareos-webui - Bareos Web-Frontend
  *
  * @link      https://github.com/bareos/bareos for the canonical source repository
- * @copyright Copyright (c) 2013-2019 Bareos GmbH & Co. KG (http://www.bareos.org/)
+ * @copyright Copyright (c) 2013-2021 Bareos GmbH & Co. KG (http://www.bareos.org/)
  * @license   GNU Affero General Public License (http://www.gnu.org/licenses/)
  *
  * This program is free software: you can redistribute it and/or modify
@@ -539,6 +539,15 @@ private function updateBvfsCache()
     }
   }
 
+  private function escapeNameString($n=null)
+  {
+    $n = preg_replace('/[\x00-\x1F\x7F]/', '', $n);
+    $replace_pairs = array('"' => '\"', '\\' => '\\\\');
+    $n = strtr($n, $replace_pairs);
+
+    return $n;
+  }
+
   /**
    * Builds a subtree as Json for JStree
    */
@@ -586,7 +595,7 @@ private function buildSubtree()
           --$dnum;
           $items .= '{';
           $items .= '"id":"-' . $dir['pathid'] . '"';
-          $items .= ',"text":"' . preg_replace('/[\x00-\x1F\x7F]/', '', str_replace('"', '\"', $dir["name"])) . '"';
+          $items .= ',"text":"' . $this->escapeNameString($dir["name"]) . '"';
           $items .= ',"icon":"glyphicon glyphicon-folder-close"';
           $items .= ',"state":""';
           $items .= ',"data":' . \Zend\Json\Json::encode($dir, \Zend\Json\Json::TYPE_OBJECT);
@@ -606,7 +615,7 @@ private function buildSubtree()
       foreach($this->files as $file) {
         $items .= '{';
         $items .= '"id":"' . $file["fileid"] . '"';
-        $items .= ',"text":"' . preg_replace('/[\x00-\x1F\x7F]/', '', str_replace('"', '\"', $file["name"])) . '"';
+        $items .= ',"text":"' . $this->escapeNameString($file["name"]) . '"';
         $items .= ',"icon":"glyphicon glyphicon-file"';
         $items .= ',"state":""';
         $items .= ',"data":' . \Zend\Json\Json::encode($file, \Zend\Json\Json::TYPE_OBJECT);

diff --git a/webui/vendor/Bareos/library/Bareos/BSock/BareosBSock.php b/webui/vendor/Bareos/library/Bareos/BSock/BareosBSock.php
@@ -964,7 +964,7 @@ public function restore($jobid=null, $client=null, $restoreclient=null, $restore
          $debug = self::receive_message();
       }
 
-      if(self::send('restore file=?b2000'.$rnd.' client='.$client.' restoreclient='.$restoreclient.' restorejob="'.$restorejob.'" where='.$where.' replace='.$replace.' yes')) {
+      if(self::send('restore file=?b2000'.$rnd.' client="'.$client.'" restoreclient="'.$restoreclient.'" restorejob="'.$restorejob.'" where="'.$where.'" replace="'.$replace.'" yes')) {
          $result = self::receive_message();
       }