Changeset 1774
- Timestamp:
- 10/27/07 12:20:13
- Files:
-
- branches/cherrypy-3.0.x/cherrypy/lib/sessions.py (modified) (1 diff)
Legend:
- Unmodified
- Added
- Removed
- Modified
- Copied
- Moved
branches/cherrypy-3.0.x/cherrypy/lib/sessions.py
r1715 r1774 261 261 262 262 def _get_file_path(self): 263 return os.path.join(self.storage_path, self.SESSION_PREFIX + self.id) 263 f = os.path.join(self.storage_path, self.SESSION_PREFIX + self.id) 264 if not os.path.normpath(f).startswith(self.storage_path): 265 raise cherrypy.HTTPError(400, "Invalid session id in cookie.") 266 return f 264 267 265 268 def _load(self, path=None):
