diff --git a/src/Site/SiteStorage.py b/src/Site/SiteStorage.py index c55a0a2b..8df7dea9 100644 --- a/src/Site/SiteStorage.py +++ b/src/Site/SiteStorage.py @@ -245,14 +245,12 @@ class SiteStorage: # Security check and return path of site's file def getPath(self, inner_path): inner_path = inner_path.replace("\\", "/") # Windows separator fix - inner_path = re.sub("^%s/" % re.escape(self.directory), "", inner_path) # Remove site directory if begins with it - file_path = u"%s/%s" % (self.directory, inner_path) if not inner_path: return self.directory - file_abspath = os.path.dirname(os.path.abspath(file_path)) - if ".." in file_path or not file_abspath.startswith(self.allowed_dir): - self.site.log.error(u"File %s not in allowed dir: %s" % (file_path, self.allowed_dir)) + file_path = u"%s/%s" % (self.directory, inner_path) + + if ".." in file_path: raise Exception(u"File not allowed: %s" % file_path) return file_path diff --git a/src/util/helper.py b/src/util/helper.py index e0f53eaa..2bdcb1b5 100644 --- a/src/util/helper.py +++ b/src/util/helper.py @@ -86,16 +86,15 @@ def unpackOnionAddress(packed): # Get dir from file # Return: data/site/content.json -> data/site def getDirname(path): - file_dir = re.sub("[^/]*?$", "", path).rstrip("/") - if file_dir: - file_dir += "/" # Add / at end if its not the root - return file_dir - + if "/" in path: + return path[:path.rfind("/")+1] + else: + return "" # Get dir from file # Return: data/site/content.json -> content.json def getFilename(path): - return re.sub("^.*/", "", path) + return path[path.rfind("/")+1:] # Convert hash to hashid for hashfield