From e869ff9bd103ad27dfc046c4540cd11b121b3829 Mon Sep 17 00:00:00 2001 From: Usman Nasir Date: Thu, 6 Feb 2020 22:11:20 +0500 Subject: [PATCH] symlink protection --- filemanager/filemanager.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/filemanager/filemanager.py b/filemanager/filemanager.py index 5cbdc81b6..98b52caf6 100755 --- a/filemanager/filemanager.py +++ b/filemanager/filemanager.py @@ -332,7 +332,10 @@ class FileManager: writeToFile.write(self.data['fileContent'].encode('utf-8')) writeToFile.close() - if os.path.islink(self.data['fileName']): + command = 'ls -la %s' % (self.data['fileName']) + output = ProcessUtilities.outputExecutioner(command) + + if output.find(website.externalApp) == -1: return self.ajaxPre(0, 'File exists and is symlink.') if self.data['fileName'].find(self.data['home']) == -1 or self.data['fileName'].find('..') > -1: