diff options
author | Lauris BH <lauris@nix.lv> | 2018-05-01 04:46:04 +0300 |
---|---|---|
committer | Bo-Yi Wu <appleboy.tw@gmail.com> | 2018-05-01 09:46:04 +0800 |
commit | 181b3a8f0988ab729270279e6e12534cb52628cc (patch) | |
tree | 33ddb166d5284c1d82b765c28634f6ba42bf3b13 /modules/lfs/server.go | |
parent | fff022ef8a924705e3fd0250aea740292ffd6552 (diff) | |
download | gitea-181b3a8f0988ab729270279e6e12534cb52628cc.tar.gz gitea-181b3a8f0988ab729270279e6e12534cb52628cc.zip |
Fix path cleanup in multiple places (#3871)
Diffstat (limited to 'modules/lfs/server.go')
-rw-r--r-- | modules/lfs/server.go | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/modules/lfs/server.go b/modules/lfs/server.go index a81d8e5c91..dc12791775 100644 --- a/modules/lfs/server.go +++ b/modules/lfs/server.go @@ -83,6 +83,8 @@ type link struct { ExpiresAt time.Time `json:"expires_at,omitempty"` } +var oidRegExp = regexp.MustCompile(`^[A-Fa-f0-9]+$`) + // ObjectOidHandler is the main request routing entry point into LFS server functions func ObjectOidHandler(ctx *context.Context) { @@ -217,6 +219,12 @@ func PostHandler(ctx *context.Context) { if !authenticate(ctx, repository, rv.Authorization, true) { requireAuth(ctx) + return + } + + if !oidRegExp.MatchString(rv.Oid) { + writeStatus(ctx, 404) + return } meta, err := models.NewLFSMetaObject(&models.LFSMetaObject{Oid: rv.Oid, Size: rv.Size, RepositoryID: repository.ID}) @@ -284,10 +292,12 @@ func BatchHandler(ctx *context.Context) { continue } - // Object is not found - meta, err = models.NewLFSMetaObject(&models.LFSMetaObject{Oid: object.Oid, Size: object.Size, RepositoryID: repository.ID}) - if err == nil { - responseObjects = append(responseObjects, Represent(object, meta, meta.Existing, !contentStore.Exists(meta))) + if oidRegExp.MatchString(object.Oid) { + // Object is not found + meta, err = models.NewLFSMetaObject(&models.LFSMetaObject{Oid: object.Oid, Size: object.Size, RepositoryID: repository.ID}) + if err == nil { + responseObjects = append(responseObjects, Represent(object, meta, meta.Existing, !contentStore.Exists(meta))) + } } } |