oci/zeronet
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Move path checking to parsePath

Browse source
This commit is contained in:
shortcutme 2017-10-04 12:39:08 +02:00
parent f53612bef7
commit 74b2408668
No known key found for this signature in database
GPG key ID: 5B63BAE6CB9613AE
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/Ui/UiRequest.py
View file

@ -435,10 +435,10 @@ class UiRequest(object):
# Serve a media for site # Serve a media for site
def actionSiteMedia(self, path, header_length=True, header_noscript=False): def actionSiteMedia(self, path, header_length=True, header_noscript=False):
if ".." in path: # File not in allowed path try:
return self.error403("Invalid file path") path_parts = self.parsePath(path)
except SecurityError as err:
path_parts = self.parsePath(path) return self.error403(err)
if not path_parts: if not path_parts:
return self.error404(path) return self.error404(path)