Mirrors/filebrowser
1
0
Fork 0
mirror of https://github.com/filebrowser/filebrowser.git synced 2026-07-17 16:36:49 +00:00
Code Issues Projects Releases Wiki Activity

fix: clean path in patch handler

Browse source
This commit is contained in:
Henrique Dias 2026-03-14 08:13:51 +01:00
parent c21af0791a
commit 4bd7d69c82
No known key found for this signature in database
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
http/resource.go
View file

@ -212,6 +212,8 @@ func resourcePatchHandler(fileCache FileCache) handleFunc {
dst := r.URL.Query().Get("destination")
action := r.URL.Query().Get("action")
dst, err := url.QueryUnescape(dst)
dst = path.Clean("/" + dst)
src = path.Clean("/" + src)
if !d.Check(src) || !d.Check(dst) {
return http.StatusForbidden, nil
}