3diy
/
moonraker
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

file_mananager: Use absolute paths instead of normalized paths 

This prevents potential issues where relative paths may be compared to absolute paths.

Signed-off-by:  Eric Callahan <arksine.code@gmail.com>
This commit is contained in:
Arksine 2021-01-05 12:09:52 -05:00
parent 6fcb26ddd7
commit fa53d889d0
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
moonraker/plugins/file_manager.py
View File

@ -15,7 +15,7 @@ from tornado.locks import Event
VALID_GCODE_EXTS = ['.gcode', '.g', '.gco'] VALID_GCODE_EXTS = ['.gcode', '.g', '.gco']
FULL_ACCESS_ROOTS = ["gcodes", "config"] FULL_ACCESS_ROOTS = ["gcodes", "config"]
METADATA_SCRIPT = os.path.normpath(os.path.join( METADATA_SCRIPT = os.path.abspath(os.path.join(
os.path.dirname(__file__), "../../scripts/extract_metadata.py")) os.path.dirname(__file__), "../../scripts/extract_metadata.py"))
class FileManager: class FileManager:
@ -78,14 +78,14 @@ class FileManager:
# Register log path # Register log path
log_file = paths.get('log_file') log_file = paths.get('log_file')
if log_file is not None: if log_file is not None:
log_path = os.path.normpath(os.path.expanduser(log_file)) log_path = os.path.abspath(os.path.expanduser(log_file))
self.server.register_static_file_handler( self.server.register_static_file_handler(
"klippy.log", log_path, force=True) "klippy.log", log_path, force=True)
def register_directory(self, root, path): def register_directory(self, root, path):
if path is None: if path is None:
return False return False
path = os.path.normpath(os.path.expanduser(path)) path = os.path.abspath(os.path.expanduser(path))
if os.path.islink(path): if os.path.islink(path):
path = os.path.realpath(path) path = os.path.realpath(path)
if not os.path.isdir(path) or path == "/": if not os.path.isdir(path) or path == "/":
@ -389,7 +389,7 @@ class FileManager:
filename = upload['filename'].strip().lstrip("/") filename = upload['filename'].strip().lstrip("/")
if dir_path: if dir_path:
filename = os.path.join(dir_path, filename) filename = os.path.join(dir_path, filename)
full_path = os.path.normpath(os.path.join(root_path, filename)) full_path = os.path.abspath(os.path.join(root_path, filename))
# Validate the path. Don't allow uploads to a parent of the root # Validate the path. Don't allow uploads to a parent of the root
if not full_path.startswith(root_path): if not full_path.startswith(root_path):
raise self.server.error( raise self.server.error(