github
/
filebrowser
mirror of https://github.com/filebrowser/filebrowser
1
0
Fork 0
Code Issues Releases Wiki Activity

fix: list symlinks with abs targets (#37)

pull/3756/head
Laurynas Gadliauskas 2023-02-24 14:04:29 +02:00 committed by GitHub
parent ee2b091e7a
commit e22451dfbf
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
http/resource.go
View File

@ -84,14 +84,12 @@ var resourceGetHandler = withUser(func(w http.ResponseWriter, r *http.Request, d
// remove symlinks that link outside base path
if fi.IsSymlink {
var fullLinkTarget string
if filepath.IsAbs(fi.Link) {
fullLinkTarget = fi.Link
} else {
fullLinkTarget = filepath.Join(d.user.FullPath(file.Path), fi.Link)
link := fi.Link
if !filepath.IsAbs(link) {
link = filepath.Join(d.user.FullPath(file.Path), link)
}
scopedLinkTarget := d.user.FullPath(filepath.Join(file.Path, fi.Link))
if fullLinkTarget != scopedLinkTarget {
link = filepath.Clean(link)
if !strings.HasPrefix(link, d.server.Root) {
return false
}
}