3diy
/
moonraker
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

file_manager: always deny access to .git folders 

Signed-off-by:  Eric Callahan <arksine.code@gmail.com>
This commit is contained in:
Eric Callahan 2022-11-06 07:21:48 -05:00
parent d490796da9
commit a8018afd46
No known key found for this signature in database
GPG Key ID: 5A1EB336DFB4C71B
1 changed files with 16 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
moonraker/components/file_manager/file_manager.py
View File

@ -251,6 +251,8 @@ class FileManager:
if isinstance(req_path, str): if isinstance(req_path, str):
req_path = pathlib.Path(req_path) req_path = pathlib.Path(req_path)
req_path = req_path.expanduser().resolve() req_path = req_path.expanduser().resolve()
if ".git" in req_path.parts:
return True
for name, (res_path, can_read) in self.reserved_paths.items(): for name, (res_path, can_read) in self.reserved_paths.items():
if ( if (
(res_path == req_path or res_path in req_path.parents) and (res_path == req_path or res_path in req_path.parents) and
@ -543,18 +545,21 @@ class FileManager:
path = pathlib.Path(path) path = pathlib.Path(path)
real_path = path.resolve() real_path = path.resolve()
fstat = path.stat() fstat = path.stat()
permissions = "rw" if ".git" in real_path.parts:
if ( permissions = ""
root not in self.full_access_roots or else:
(path.is_symlink() and path.is_file()) permissions = "rw"
): if (
permissions = "r" root not in self.full_access_roots or
for name, (res_path, can_read) in self.reserved_paths.items(): (path.is_symlink() and path.is_file())
if (res_path == real_path or res_path in real_path.parents): ):
if not can_read:
permissions = ""
break
permissions = "r" permissions = "r"
for name, (res_path, can_read) in self.reserved_paths.items():
if (res_path == real_path or res_path in real_path.parents):
if not can_read:
permissions = ""
break
permissions = "r"
return { return {
'modified': fstat.st_mtime, 'modified': fstat.st_mtime,
'size': fstat.st_size, 'size': fstat.st_size,