diff options
| author | zeripath <art27@cantab.net> | 2019-01-04 16:29:36 +0000 |
|---|---|---|
| committer | Jonas Franz <info@jonasfranz.software> | 2019-01-04 17:29:36 +0100 |
| commit | 6076674d3a699fcccd6509fe98af1d1dc731f1c7 (patch) | |
| tree | d4f669a56792e26cc7ea6fa64c7c484b88707228 | |
| parent | 28cc3bd6623ad365306c42e4f726eaa2d06cb4c8 (diff) | |
| download | gitea-6076674d3a699fcccd6509fe98af1d1dc731f1c7.tar.gz gitea-6076674d3a699fcccd6509fe98af1d1dc731f1c7.zip | |
SECURITY: protect DeleteFilePost et al with cleanUploadFileName (#5631) (#5634)
This commit wraps more of the TreePaths with cleanUploadFileName
Signed-off-by: Andrew Thornton <art27@cantab.net>
| -rw-r--r-- | routers/repo/editor.go | 20 |
1 files changed, 18 insertions, 2 deletions
diff --git a/routers/repo/editor.go b/routers/repo/editor.go index f64b0002ae..4e3557dbb2 100644 --- a/routers/repo/editor.go +++ b/routers/repo/editor.go @@ -163,7 +163,11 @@ func editFilePost(ctx *context.Context, form auth.EditRepoFileForm, isNewFile bo branchName = form.NewBranchName } - form.TreePath = strings.Trim(path.Clean("/"+form.TreePath), " /") + form.TreePath = cleanUploadFileName(form.TreePath) + if len(form.TreePath) == 0 { + ctx.Error(500, "Upload file name is invalid") + return + } treeNames, treePaths := getParentTreeFields(form.TreePath) ctx.Data["TreePath"] = form.TreePath @@ -373,6 +377,13 @@ func DeleteFile(ctx *context.Context) { func DeleteFilePost(ctx *context.Context, form auth.DeleteRepoFileForm) { ctx.Data["PageIsDelete"] = true ctx.Data["BranchLink"] = ctx.Repo.RepoLink + "/src/" + ctx.Repo.BranchNameSubURL() + + ctx.Repo.TreePath = cleanUploadFileName(ctx.Repo.TreePath) + if len(ctx.Repo.TreePath) == 0 { + ctx.Error(500, "Delete file name is invalid") + return + } + ctx.Data["TreePath"] = ctx.Repo.TreePath canCommit := renderCommitRights(ctx) @@ -477,7 +488,12 @@ func UploadFilePost(ctx *context.Context, form auth.UploadRepoFileForm) { branchName = form.NewBranchName } - form.TreePath = strings.Trim(path.Clean("/"+form.TreePath), " /") + form.TreePath = cleanUploadFileName(form.TreePath) + if len(form.TreePath) == 0 { + ctx.Error(500, "Upload file name is invalid") + return + } + treeNames, treePaths := getParentTreeFields(form.TreePath) if len(treeNames) == 0 { // We must at least have one element for user to input. |