entrouvert
/
passerelle
15
0
Fork 0
Code Issues Pull Requests 15 Releases Activity

misc: let django.views.static.serve do its job (#75700)
gitea/passerelle/pipeline/head This commit looks good Details 

It already checks the security of the given path through
django.utils._os.safe_join() and checks if the file exists.
This commit is contained in:
Benjamin Dauvergne 2023-03-24 09:18:52 +01:00 committed by Gitea
parent 2fbfeedb14
commit 9c85b556f2
1 changed files with 0 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
passerelle/views.py
View File

@ -19,7 +19,6 @@ import hashlib
import inspect
import json
import logging
import os
import uuid
from urllib.parse import quote
@ -637,13 +636,4 @@ class GenericExportConnectorView(GenericConnectorMixin, DetailView):
class MediaView(View):
def get(self, request, path, *args, **kwargs):
document_root = DefaultStorage().location
filename = DefaultStorage().path(path)
filename = os.path.realpath(filename)
if (
not os.path.isabs(filename)
or not filename.startswith(document_root)
or not os.path.exists(filename)
or not os.path.isfile(filename)
):
raise Http404()
return serve(request, path, document_root=document_root, show_indexes=False)