changeset bdea3f9af35f in trytond:default
details: https://hg.tryton.org/trytond?cmd=changeset;node=bdea3f9af35f
description:
Use safe_join in SharedDataMiddlewareIndex
issue10068
review333851027
diffstat:
CHANGELOG | 1 +
trytond/wsgi.py | 16 +++++++++++-----
2 files changed, 12 insertions(+), 5 deletions(-)
diffs (50 lines):
diff -r b4145920e57e -r bdea3f9af35f CHANGELOG
--- a/CHANGELOG Wed Feb 10 23:52:22 2021 +0100
+++ b/CHANGELOG Fri Feb 12 10:01:22 2021 +0100
@@ -1,3 +1,4 @@
+* Use safe_join in SharedDataMiddlewareIndex (issue10068)
* Use menu name for window opened from menu
* Add trigonometric functions to sqlite backend
* Allow skipping user warnings globally
diff -r b4145920e57e -r bdea3f9af35f trytond/wsgi.py
--- a/trytond/wsgi.py Wed Feb 10 23:52:22 2021 +0100
+++ b/trytond/wsgi.py Fri Feb 12 10:01:22 2021 +0100
@@ -4,6 +4,7 @@
import http.client
import logging
import os
+import posixpath
import sys
import traceback
import urllib.parse
@@ -25,6 +26,10 @@
except ImportError:
from werkzeug.contrib.fixers import ProxyFix as NumProxyFix
try:
+ from werkzeug.security import safe_join
+except ImportError:
+ safe_join = posixpath.join
+try:
from werkzeug.middleware.shared_data import SharedDataMiddleware
except ImportError:
from werkzeug.wsgi import SharedDataMiddleware
@@ -201,13 +206,14 @@
def get_directory_loader(self, directory):
def loader(path):
if path is not None:
- path = os.path.join(directory, path)
+ path = safe_join(directory, path)
else:
path = directory
- if os.path.isdir(path):
- path = os.path.join(path, 'index.html')
- if os.path.isfile(path):
- return os.path.basename(path), self._opener(path)
+ if path is not None:
+ if os.path.isdir(path):
+ path = posixpath.join(path, 'index.html')
+ if os.path.isfile(path):
+ return os.path.basename(path), self._opener(path)
return None, None
return loader
