From 960f3a6552a47549ef46dee5f9579ccf317d7bbf Mon Sep 17 00:00:00 2001 From: Kyle Neideck Date: Sat, 11 Mar 2017 13:58:28 +1100 Subject: [PATCH] [WebUI] Check render template files exist and raise 404 if not - Check render/* requests match to .html files in the 'render' dir - Protects against directory (path) traversal --- deluge/ui/web/server.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/deluge/ui/web/server.py b/deluge/ui/web/server.py index e14c89a6d..a02609f53 100644 --- a/deluge/ui/web/server.py +++ b/deluge/ui/web/server.py @@ -126,6 +126,10 @@ class Upload(resource.Resource): class Render(resource.Resource): + def __init__(self): + resource.Resource.__init__(self) + # Make a list of all the template files to check requests against. + self.template_files = fnmatch.filter(os.listdir(rpath('render')), '*.html') def getChild(self, path, request): # NOQA: N802 request.render_file = path @@ -136,6 +140,10 @@ class Render(resource.Resource): request.setResponseCode(http.INTERNAL_SERVER_ERROR) return '' + if request.render_file not in self.template_files: + request.setResponseCode(http.NOT_FOUND) + return '

404 - Not Found

' + filename = os.path.join('render', request.render_file) template = Template(filename=rpath(filename)) request.setHeader(b'content-type', b'text/html')