GitHub/Anki
1
0
Fork 0
mirror of https://github.com/ankitects/anki.git synced 2025-09-19 06:22:22 -04:00
Code Issues Projects Releases Packages 1 Wiki Activity Actions

if webexports does not match, return 403

Browse source
This commit is contained in:
Damien Elmes 2020-07-07 10:50:03 +10:00
parent 704db541ea
commit 4ab9d04c95
1 changed files with 14 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
qt/aqt/mediasrv.py
View file

@ -90,7 +90,14 @@ class MediaServer(threading.Thread):
@app.route("/", defaults={"path": ""}) @app.route("/", defaults={"path": ""})
@app.route("/<path:pathin>", methods=["GET", "POST"]) @app.route("/<path:pathin>", methods=["GET", "POST"])
def allroutes(pathin): def allroutes(pathin):
try:
directory, path = _redirectWebExports(pathin) directory, path = _redirectWebExports(pathin)
except TypeError:
return flask.make_response(
f"Invalid path: {pathin}",
HTTPStatus.FORBIDDEN,
)
try: try:
isdir = os.path.isdir(os.path.join(directory, path)) isdir = os.path.isdir(os.path.join(directory, path))
except ValueError: except ValueError:
@ -176,18 +183,18 @@ def _redirectWebExports(path):
except AttributeError as error: except AttributeError as error:
if devMode: if devMode:
print("_redirectWebExports: %s" % error) print("_redirectWebExports: %s" % error)
return _exportFolder, addonPath return None
try: try:
addon, subPath = addonPath.split("/", 1) addon, subPath = addonPath.split("/", 1)
except ValueError: except ValueError:
return addMgr.addonsFolder(), path return None
if not addon: if not addon:
return addMgr.addonsFolder(), path return None
pattern = addMgr.getWebExports(addon) pattern = addMgr.getWebExports(addon)
if not pattern: if not pattern:
return addMgr.addonsFolder(), path return None
if re.fullmatch(pattern, subPath): if re.fullmatch(pattern, subPath):
return addMgr.addonsFolder(), addonPath return addMgr.addonsFolder(), addonPath