diff options
| author | ᴜɴᴋɴᴡᴏɴ <u@gogs.io> | 2020-02-19 23:45:02 +0800 |
|---|---|---|
| committer | ᴜɴᴋɴᴡᴏɴ <u@gogs.io> | 2020-02-19 23:45:02 +0800 |
| commit | ce1ec81d6fa4b9531eee8c51a6ce1a095ea9beb2 (patch) | |
| tree | 66d77fa7507ad3c5a8fcfbdefe1451b1d06a810d /internal/route/repo/editor.go | |
| parent | 33c6341ccd765fa631d6863aeeca12a6a5e04658 (diff) | |
repo/editor: clean up tree path
Fixes a security issue reported by @zeripath.
Diffstat (limited to 'internal/route/repo/editor.go')
| -rw-r--r-- | internal/route/repo/editor.go | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/internal/route/repo/editor.go b/internal/route/repo/editor.go index a3ca3d70..54f6c20b 100644 --- a/internal/route/repo/editor.go +++ b/internal/route/repo/editor.go @@ -18,6 +18,7 @@ import ( "gogs.io/gogs/internal/db" "gogs.io/gogs/internal/db/errors" "gogs.io/gogs/internal/form" + "gogs.io/gogs/internal/pathutil" "gogs.io/gogs/internal/setting" "gogs.io/gogs/internal/template" "gogs.io/gogs/internal/tool" @@ -141,7 +142,7 @@ func editFilePost(c *context.Context, f form.EditRepoFile, isNewFile bool) { branchName = f.NewBranchName } - f.TreePath = strings.Trim(path.Clean("/"+f.TreePath), " /") + f.TreePath = pathutil.Clean(f.TreePath) treeNames, treePaths := getParentTreeFields(f.TreePath) c.Data["ParentTreePath"] = path.Dir(c.Repo.TreePath) @@ -339,6 +340,8 @@ func DeleteFile(c *context.Context) { func DeleteFilePost(c *context.Context, f form.DeleteRepoFile) { c.PageIs("Delete") c.Data["BranchLink"] = c.Repo.RepoLink + "/src/" + c.Repo.BranchName + + c.Repo.TreePath = pathutil.Clean(c.Repo.TreePath) c.Data["TreePath"] = c.Repo.TreePath oldBranchName := c.Repo.BranchName @@ -433,7 +436,7 @@ func UploadFilePost(c *context.Context, f form.UploadRepoFile) { branchName = f.NewBranchName } - f.TreePath = strings.Trim(path.Clean("/"+f.TreePath), " /") + f.TreePath = pathutil.Clean(f.TreePath) treeNames, treePaths := getParentTreeFields(f.TreePath) if len(treeNames) == 0 { // We must at least have one element for user to input. |