rt/NomadNet
1
0
Fork 0
mirror of https://github.com/markqvist/NomadNet.git synced 2026-10-26 02:48:48 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Cleanup

Browse source
This commit is contained in:
Mark Qvist 2026-09-06 00:51:12 +02:00
parent 38165804ae
commit 4544335324
No known key found for this signature in database
1 changed files with 12 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

17
nomadnet/Node.py
View file

@ -162,11 +162,18 @@ class Node:
if not type(data) == dict: return None if not type(data) == dict: return None
if not "path" in data: return None if not "path" in data: return None
if not "key" in data: return None if not "key" in data: return None
media_path = data["path"].replace("/media/", "").lstrip("/").replace("../", "")
media_path = f"{self.app.pagespath}/{media_path}" jail = os.path.normpath(self.app.pagespath)
if not media_path.startswith(self.app.pagespath): media_path = os.path.join(self.app.pagespath, data["path"].replace("/media/", "").lstrip("/"))
media_path = os.path.normpath(media_path)
if not media_path.startswith(jail+os.sep):
RNS.log(f"Invalid media request path: {media_path}", RNS.LOG_DEBUG) RNS.log(f"Invalid media request path: {media_path}", RNS.LOG_DEBUG)
return None return False
if len(media_path) > 512:
RNS.log(f"Invalid media request path length: {len(media_path)}", RNS.LOG_DEBUG)
return False
RNS.log(f"Media request {RNS.prettyhexrep(request_id)} for: {media_path}", RNS.LOG_VERBOSE) RNS.log(f"Media request {RNS.prettyhexrep(request_id)} for: {media_path}", RNS.LOG_VERBOSE)
try: try:
@ -189,7 +196,7 @@ class Node:
except Exception as e: except Exception as e:
RNS.log("Error occurred while handling request "+RNS.prettyhexrep(request_id)+" for: "+str(media_path), RNS.LOG_ERROR) RNS.log("Error occurred while handling request "+RNS.prettyhexrep(request_id)+" for: "+str(media_path), RNS.LOG_ERROR)
RNS.log("The contained exception was: "+str(e), RNS.LOG_ERROR) RNS.log("The contained exception was: "+str(e), RNS.LOG_ERROR)
return None return False
def request_allowed(self, file_path, remote_identity): def request_allowed(self, file_path, remote_identity):
allowed_path = file_path+".allowed" allowed_path = file_path+".allowed"