GitHub/Anki
1
0
Fork 0
mirror of https://github.com/ankitects/anki.git synced 2025-09-18 22:12:21 -04:00
Code Issues Projects Releases Packages 1 Wiki Activity Actions

if webexports does not match, return 403

Browse source
This commit is contained in:
Damien Elmes 2020-07-07 10:50:03 +10:00
parent 704db541ea
commit 4ab9d04c95
1 changed files with 14 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
qt/aqt/mediasrv.py
View file

@ -90,7 +90,14 @@ class MediaServer(threading.Thread):
@app.route("/", defaults={"path": ""}) @app.route("/", defaults={"path": ""})
@app.route("/<path:pathin>", methods=["GET", "POST"]) @app.route("/<path:pathin>", methods=["GET", "POST"])
def allroutes(pathin): def allroutes(pathin):
try:
directory, path = _redirectWebExports(pathin) directory, path = _redirectWebExports(pathin)
except TypeError:
return flask.make_response(
f"Invalid path: {pathin}",
HTTPStatus.FORBIDDEN,
)
try: try:
isdir = os.path.isdir(os.path.join(directory, path)) isdir = os.path.isdir(os.path.join(directory, path))
except ValueError: except ValueError:
@ -164,30 +171,30 @@ def _redirectWebExports(path):
# catch /_anki references and rewrite them to web export folder # catch /_anki references and rewrite them to web export folder
targetPath = "_anki/" targetPath = "_anki/"
if path.startswith(targetPath): if path.startswith(targetPath):
return _exportFolder, path[len(targetPath) :] return _exportFolder, path[len(targetPath):]
# catch /_addons references and rewrite them to addons folder # catch /_addons references and rewrite them to addons folder
targetPath = "_addons/" targetPath = "_addons/"
if path.startswith(targetPath): if path.startswith(targetPath):
addonPath = path[len(targetPath) :] addonPath = path[len(targetPath):]
try: try:
addMgr = aqt.mw.addonManager addMgr = aqt.mw.addonManager
except AttributeError as error: except AttributeError as error:
if devMode: if devMode:
print("_redirectWebExports: %s" % error) print("_redirectWebExports: %s" % error)
return _exportFolder, addonPath return None
try: try:
addon, subPath = addonPath.split("/", 1) addon, subPath = addonPath.split("/", 1)
except ValueError: except ValueError:
return addMgr.addonsFolder(), path return None
if not addon: if not addon:
return addMgr.addonsFolder(), path return None
pattern = addMgr.getWebExports(addon) pattern = addMgr.getWebExports(addon)
if not pattern: if not pattern:
return addMgr.addonsFolder(), path return None
if re.fullmatch(pattern, subPath): if re.fullmatch(pattern, subPath):
return addMgr.addonsFolder(), addonPath return addMgr.addonsFolder(), addonPath