Nemcio/Gogs
1
0
Fork 0
mirror of https://github.com/gogs/gogs.git synced 2026-05-07 12:27:06 +02:00
Code Issues Packages Projects Releases Wiki Activity

models/repo_editor: sanitize user-defined file name to prevent RCE (#5558)

Browse Source 
Reported by PentesterLab (https://pentesterlab.com).
This commit is contained in:
Unknwon
2018-12-18 01:31:04 -05:00
parent d74437af57
commit 86ada87529
4 changed files with 31 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
models/repo_editor.go
View File

@@ -328,7 +328,7 @@ func (upload *Upload) LocalPath() string {
func NewUpload(name string, buf []byte, file multipart.File) (_ *Upload, err error) {
upload := &Upload{
UUID: gouuid.NewV4().String(),
Name: name,
Name: tool.SanitizePath(name),
}
localPath := upload.LocalPath()