mirror of
https://github.com/PurpleI2P/i2pd.git
synced 2026-10-20 08:02:30 +00:00
reject url with . as file name
This commit is contained in:
@@ -988,7 +988,7 @@ namespace torrents
|
||||
LogPrint (eLogDebug, "TorrentsRPC: Tunnel not found or web is not supported ", subUrlPath->string ());
|
||||
}
|
||||
}
|
||||
if (!isPathValid || fileSubUrl.string ().find ("..") != std::string::npos)
|
||||
if (!isPathValid || fileSubUrl.string ().find ("..") != std::string::npos || fileSubUrl == ".")
|
||||
{
|
||||
SendResponse (boost::beast::http::status::forbidden);
|
||||
return;
|
||||
|
||||
Reference in New Issue
Block a user