diff options
| author | sillyguodong <33891828+sillyguodong@users.noreply.github.com> | 2023-02-12 09:31:14 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-02-12 09:31:14 +0800 |
| commit | 51ab4951985b0827fef29aea7c854325309dc3dd (patch) | |
| tree | 47ac706f45ebb44bda6f3a8e2b2fb3b54c138069 /modules | |
| parent | 8fa54d0fda4ee5175619bed8fd959b590ef1e5c7 (diff) | |
| download | gitea-51ab4951985b0827fef29aea7c854325309dc3dd.tar.gz gitea-51ab4951985b0827fef29aea7c854325309dc3dd.zip | |
escape filename when assemble URL (#22850)
Fixes: #22843
### Cause:
https://github.com/go-gitea/gitea/blob/affdd40296960a08a4223330ccbd1fb88c96ea1a/services/repository/files/content.go#L161
Previously, we did not escape the **"%"** that might be in "treePath"
when call "url.parse()".
This function will check whether "%" is the beginning of an escape
character. Obviously, the "%" in the example (hello%mother.txt) is not
that. So, the function will return a error.
### Solution:
We can escape "treePath" by call "url.PathEscape()" function firstly.
### Screenshot:
---------
Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: Andrew Thornton <art27@cantab.net>
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/lfs/endpoint.go | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/modules/lfs/endpoint.go b/modules/lfs/endpoint.go index 3ae3cf077b..2931defcd9 100644 --- a/modules/lfs/endpoint.go +++ b/modules/lfs/endpoint.go @@ -4,7 +4,6 @@ package lfs import ( - "fmt" "net/url" "os" "path" @@ -12,6 +11,7 @@ import ( "strings" "code.gitea.io/gitea/modules/log" + "code.gitea.io/gitea/modules/util" ) // DetermineEndpoint determines an endpoint from the clone url or uses the specified LFS url. @@ -95,7 +95,7 @@ func endpointFromLocalPath(path string) *url.URL { return nil } - path = fmt.Sprintf("file://%s%s", slash, filepath.ToSlash(path)) + path = "file://" + slash + util.PathEscapeSegments(filepath.ToSlash(path)) u, _ := url.Parse(path) |