Cutlery/calibre
1
0
Fork 0
mirror of https://github.com/kovidgoyal/calibre.git synced 2025-07-09 03:04:10 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix #7980 (Security vulnerability in Calibre 0.7.34)

Browse Source
This commit is contained in:
Kovid Goyal 2010-12-20 14:48:25 -07:00
parent 6e3d2db96c
commit cddf207277
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/calibre/library/server/content.py
View File

@ -5,7 +5,7 @@ __license__ = 'GPL v3'
__copyright__ = '2010, Kovid Goyal <kovid@kovidgoyal.net>' __copyright__ = '2010, Kovid Goyal <kovid@kovidgoyal.net>'
__docformat__ = 'restructuredtext en' __docformat__ = 'restructuredtext en'
import re, os import re, os, posixpath
import cherrypy import cherrypy
@ -88,17 +88,24 @@ class ContentServer(object):
def static(self, name): def static(self, name):
'Serves static content' 'Serves static content'
name = name.lower() name = name.lower()
cherrypy.response.headers['Content-Type'] = { fname = posixpath.basename(name)
try:
cherrypy.response.headers['Content-Type'] = {
'js' : 'text/javascript', 'js' : 'text/javascript',
'css' : 'text/css', 'css' : 'text/css',
'png' : 'image/png', 'png' : 'image/png',
'gif' : 'image/gif', 'gif' : 'image/gif',
'html' : 'text/html', 'html' : 'text/html',
'' : 'application/octet-stream', }[fname.rpartition('.')[-1].lower()]
}[name.rpartition('.')[-1].lower()] except KeyError:
raise cherrypy.HTTPError(404, '%r not a valid resource type'%name)
cherrypy.response.headers['Last-Modified'] = self.last_modified(self.build_time) cherrypy.response.headers['Last-Modified'] = self.last_modified(self.build_time)
path = P('content_server/'+name) basedir = os.path.abspath(P('content_server'))
if not os.path.exists(path): path = os.path.join(basedir, name.replace('/', os.sep))
path = os.path.abspath(path)
if not path.startswith(basedir):
raise cherrypy.HTTPError(403, 'Access to %s is forbidden'%name)
if not os.path.exists(path) or not os.path.isfile(path):
raise cherrypy.HTTPError(404, '%s not found'%name) raise cherrypy.HTTPError(404, '%s not found'%name)
if self.opts.develop: if self.opts.develop:
lm = fromtimestamp(os.stat(path).st_mtime) lm = fromtimestamp(os.stat(path).st_mtime)