mirrors/mycorrhiza
1
0
Fork 0
mirror of https://github.com/osmarks/mycorrhiza.git synced 2025-10-31 07:33:00 +00:00
Code Issues Releases Wiki Activity

Make sure the uploaded hypha filepath is nested in wiki dir

Browse Source 
I couldn't make it work differently though
This commit is contained in:
Timur Ismagilov
2021-06-15 01:27:25 +05:00
parent cbfa89b720
commit b4e0ff2e34
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
shroom/upload.go
View File

@@ -9,6 +9,7 @@ import (
"mime/multipart" "mime/multipart"
"os" "os"
"path/filepath" "path/filepath"
"strings"
"github.com/bouncepaw/mycorrhiza/history" "github.com/bouncepaw/mycorrhiza/history"
"github.com/bouncepaw/mycorrhiza/hyphae" "github.com/bouncepaw/mycorrhiza/hyphae"
@@ -31,7 +32,6 @@ func UploadText(h *hyphae.Hypha, data []byte, message string, u *user.User) (hop
hop.WithMsg(fmt.Sprintf("%s ‘%s’: %s", action, h.Name, message)) hop.WithMsg(fmt.Sprintf("%s ‘%s’: %s", action, h.Name, message))
} }
if err, errtitle := CanEdit(u, h); err != nil { if err, errtitle := CanEdit(u, h); err != nil {
return hop.WithErrAbort(err), errtitle return hop.WithErrAbort(err), errtitle
} }
@@ -64,9 +64,16 @@ func UploadBinary(h *hyphae.Hypha, mime string, file multipart.File, u *user.Use
// uploadHelp is a helper function for UploadText and UploadBinary // uploadHelp is a helper function for UploadText and UploadBinary
func uploadHelp(h *hyphae.Hypha, hop *history.HistoryOp, ext string, data []byte, u *user.User) (*history.HistoryOp, string) { func uploadHelp(h *hyphae.Hypha, hop *history.HistoryOp, ext string, data []byte, u *user.User) (*history.HistoryOp, string) {
var ( var (
fullPath = filepath.Join(cfg.WikiDir, h.Name+ext) fullPath, err = filepath.EvalSymlinks(filepath.Join(cfg.WikiDir, h.Name+ext))
originalFullPath = &h.TextPath originalFullPath = &h.TextPath
) )
if err != nil {
return hop.WithErrAbort(err), err.Error()
}
if !strings.HasPrefix(fullPath, cfg.WikiDir) { // If the path somehow got outside the wiki dir
err = errors.New("bad path")
return hop.WithErrAbort(err), err.Error()
}
if hop.Type == history.TypeEditBinary { if hop.Type == history.TypeEditBinary {
originalFullPath = &h.BinaryPath originalFullPath = &h.BinaryPath
} }