changeset 69ea25e4e4b5 in trytond:5.6
details: https://hg.tryton.org/trytond?cmd=changeset;node=69ea25e4e4b5
description:
Use safe_join in SharedDataMiddlewareIndex
issue10068
review333851027
(grafted from bdea3f9af35fd8305363384a504f0ad2aade5474)
diffstat:
CHANGELOG | 2 ++
trytond/wsgi.py | 16 +++++++++++-----
2 files changed, 13 insertions(+), 5 deletions(-)
diffs (51 lines):
diff -r 4a78963b1e9d -r 69ea25e4e4b5 CHANGELOG
--- a/CHANGELOG Wed Feb 10 23:52:22 2021 +0100
+++ b/CHANGELOG Fri Feb 12 10:01:22 2021 +0100
@@ -1,3 +1,5 @@
+* Use safe_join in SharedDataMiddlewareIndex (issue10068)
+
Version 5.6.12 - 2021-02-01
* Bug fixes (see mercurial logs for details)
diff -r 4a78963b1e9d -r 69ea25e4e4b5 trytond/wsgi.py
--- a/trytond/wsgi.py Wed Feb 10 23:52:22 2021 +0100
+++ b/trytond/wsgi.py Fri Feb 12 10:01:22 2021 +0100
@@ -4,6 +4,7 @@
import http.client
import logging
import os
+import posixpath
import sys
import traceback
import urllib.parse
@@ -25,6 +26,10 @@
except ImportError:
from werkzeug.contrib.fixers import ProxyFix as NumProxyFix
try:
+ from werkzeug.security import safe_join
+except ImportError:
+ safe_join = posixpath.join
+try:
from werkzeug.middleware.shared_data import SharedDataMiddleware
except ImportError:
from werkzeug.wsgi import SharedDataMiddleware
@@ -193,13 +198,14 @@
def get_directory_loader(self, directory):
def loader(path):
if path is not None:
- path = os.path.join(directory, path)
+ path = safe_join(directory, path)
else:
path = directory
- if os.path.isdir(path):
- path = os.path.join(path, 'index.html')
- if os.path.isfile(path):
- return os.path.basename(path), self._opener(path)
+ if path is not None:
+ if os.path.isdir(path):
+ path = posixpath.join(path, 'index.html')
+ if os.path.isfile(path):
+ return os.path.basename(path), self._opener(path)
return None, None
return loader
