Prohibited uploading of certain files

Author: vasil-sokolov

Module.php

@@ -220,6 +220,26 @@ protected function getHtmlTitle($sUrl)
         return isset($aTitle['1']) ? trim($aTitle['1']) : '';
     }
 
+    /**
+     * Checks if file name is allowed.
+     *
+     * @param string $FileName
+     *
+     * @return bool
+     */
+    protected function isFileAllowed($FileName)
+    {
+        $forbiddenFileList = [
+            '.sabredav'
+        ];
+
+        $FileName = \trim(\MailSo\Base\Utils::ClearFileName($FileName));
+
+        $result = !in_array($FileName, $forbiddenFileList);
+
+        return  $result;
+    }
+
     /**
      * Puts file content to $mResult.
      * @ignore
@@ -257,6 +277,10 @@ public function onGetFile($aArgs, &$mResult)
     public function onCreateFile($aArgs, &$mResult)
     {
         if ($this->checkStorageType($aArgs['Type'])) {
+            if (!self::isFileAllowed($aArgs['Name'])) {
+                throw new \Aurora\System\Exceptions\ApiException(\Aurora\System\Notifications::CanNotUploadFileErrorData);
+            }
+
             $UserId = $aArgs['UserId'];
             Api::CheckAccess($UserId);
 
@@ -572,6 +596,10 @@ public function onAfterRename(&$aArgs, &$mResult)
             $UserId = $aArgs['UserId'];
             Api::CheckAccess($UserId);
 
+            if (self::isFileAllowed($aArgs['Name'])) {
+                throw new \Aurora\System\Exceptions\ApiException(\Aurora\System\Notifications::CanNotUploadFileErrorData);
+            }
+
             $sUserPiblicId = Api::getUserPublicIdById($UserId);
             $sNewName = \trim(\MailSo\Base\Utils::ClearFileName($aArgs['NewName']));
 
@@ -635,6 +663,11 @@ public function onAfterMove(&$aArgs, &$mResult)
 
                 if (!$bIntoItself) {
                     $sNewName = isset($aItem['NewName']) ? $aItem['NewName'] : $aItem['Name'];
+
+                    if (self::IsFileAllowed(basename($sNewName))) {
+                        throw new \Aurora\System\Exceptions\ApiException(\Aurora\System\Notifications::CanNotUploadFileErrorData);
+                    }
+
                     $sNewName = $this->getManager()->getNonExistentFileName(
                         $sUserPiblicId,
                         $aArgs['ToType'],