Changeset 1003
- Timestamp:
- 03/10/06 02:58:25
- Files:
-
- trunk/cherrypy/filters/staticfilter.py (modified) (2 diffs)
Legend:
- Unmodified
- Added
- Removed
- Modified
- Copied
- Moved
trunk/cherrypy/filters/staticfilter.py
r927 r1003 27 27 filename = config.get('static_filter.file') 28 28 if filename: 29 static Dir = None29 static_dir = None 30 30 else: 31 static Dir = config.get('static_filter.dir')32 if not static Dir:31 static_dir = config.get('static_filter.dir') 32 if not static_dir: 33 33 msg = ("StaticFilter requires either static_filter.file " 34 34 "or static_filter.dir (%s)" % request.path) 35 35 raise cherrypy.WrongConfigValue(msg) 36 section = config.get('static_filter.dir', return_section =True)36 section = config.get('static_filter.dir', return_section = True) 37 37 if section == 'global': 38 38 section = "/" 39 39 section = section.rstrip(r"\/") 40 extra Path = path[len(section) + 1:]41 extra Path = extraPath.lstrip(r"\/")42 extra Path = urllib.unquote(extraPath)43 # If extra Path is "", filename will end in a slash44 filename = os.path.join(static Dir, extraPath)40 extra_path = path[len(section) + 1:] 41 extra_path = extra_path.lstrip(r"\/") 42 extra_path = urllib.unquote(extra_path) 43 # If extra_path is "", filename will end in a slash 44 filename = os.path.join(static_dir, extra_path) 45 45 46 46 # If filename is relative, make absolute using "root". … … 55 55 56 56 # If we used static_filter.dir, then there's a chance that the 57 # extra Path pulled from the URL might have ".." or similar uplevel58 # attacks in it. Check that the final file is a child of static Dir.57 # extra_path pulled from the URL might have ".." or similar uplevel 58 # attacks in it. Check that the final file is a child of static_dir. 59 59 # Note that we do not check static_filter.file--that can point 60 60 # anywhere (since it does not use the request URL). 61 if static Dir:62 if not os.path.isabs(static Dir):63 static Dir = os.path.join(root, staticDir)64 if not os.path.normpath(filename).startswith(os.path.normpath(static Dir)):61 if static_dir: 62 if not os.path.isabs(static_dir): 63 static_dir = os.path.join(root, static_dir) 64 if not os.path.normpath(filename).startswith(os.path.normpath(static_dir)): 65 65 raise cherrypy.HTTPError(403) # Forbidden 66 66

