From d2b9555508b8cc03c4158274e12b085ed7d81237 Mon Sep 17 00:00:00 2001 From: HelloZeroNet Date: Mon, 18 Apr 2016 00:47:26 +0200 Subject: [PATCH] Fix data dir detection --- src/Ui/UiRequest.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Ui/UiRequest.py b/src/Ui/UiRequest.py index f3256eef..8dfd706c 100644 --- a/src/Ui/UiRequest.py +++ b/src/Ui/UiRequest.py @@ -331,7 +331,7 @@ class UiRequest(object): address = path_parts["address"] file_path = "%s/%s/%s" % (config.data_dir, address, path_parts["inner_path"]) allowed_dir = os.path.abspath("%s/%s" % (config.data_dir, address)) # Only files within data/sitehash allowed - data_dir = os.path.abspath("data") # No files from data/ allowed + data_dir = os.path.abspath(config.data_dir) # No files from data/ allowed if ( ".." in file_path or not os.path.dirname(os.path.abspath(file_path)).startswith(allowed_dir) or