rt/NomadNet
1
0
Fork 0
mirror of https://github.com/markqvist/NomadNet.git synced 2026-10-25 18:40:13 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixed /media request handler allowing serving of .allowed files

Browse source
This commit is contained in:
Mark Qvist 2026-09-08 13:19:32 +02:00
parent 3a5fd73ee0
commit 774c08905f
No known key found for this signature in database
2 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nomadnet/Node.py
View file

@ -158,6 +158,7 @@ class Node:
RNS.log("The contained exception was: "+str(e), RNS.LOG_ERROR)
return None
MEDIA_EXTS = [".webp"]
def serve_media(self, path, data, request_id, link_id, remote_identity, requested_at):
if not type(data) == dict: return None
if not "path" in data: return None
@ -166,6 +167,12 @@ class Node:
jail = os.path.normpath(self.app.pagespath)
media_path = os.path.join(self.app.pagespath, data["path"].replace("/media/", "").lstrip("/"))
media_path = os.path.normpath(media_path)
base_name = os.path.basename(media_path)
base_ext = os.path.splitext(base_name)[-1]
if not base_ext.lower() in self.MEDIA_EXTS:
RNS.log(f"Invalid media request type: {media_path}, must be in {self.MEDIA_EXTS}", RNS.LOG_DEBUG)
return False
if not media_path.startswith(jail+os.sep):
RNS.log(f"Invalid media request path: {media_path}", RNS.LOG_DEBUG)
@ -199,9 +206,9 @@ class Node:
return False
def request_allowed(self, file_path, remote_identity):
if file_path.lower().endswith(".allowed"): return False
allowed_path = file_path+".allowed"
if not os.path.isfile(allowed_path):
return True
if not os.path.isfile(allowed_path): return True
allowed_list = []
try:

2
nomadnet/ui/textui/images/_imagedata.py
View file

@ -62,7 +62,7 @@ def parse_image_header(data):
if data[:4] == b"RIFF" and data[8:12] == b"WEBP":
w, h = _parse_webp(data)
return "WebP", w, h
raise ValueError("unsupported image format (only PNG and WebP)")
raise ValueError("unsupported image format")
# Loads an image file and exposes its PNG bytes and dimensions.
# The payload is always a PNG file, transmitted verbatim to the terminal