mirrors/etherpad-lite
1
0
Fork 0
mirror of https://github.com/ether/etherpad-lite.git synced 2025-04-22 00:16:15 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 26

Merge pull request #148 from adrianlang/master

Browse source 
Fix directory traversal
This commit is contained in:
Peter 'Pita' Martischka 2011-09-01 14:36:23 -07:00
commit a1a1017bfe
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
node/server.js
View file

@ -99,7 +99,8 @@ async.waterfall([
app.get('/static/*', function(req, res) app.get('/static/*', function(req, res)
{ {
res.header("Server", serverName); res.header("Server", serverName);
var filePath = path.normalize(__dirname + "/.." + req.url.split("?")[0]); var filePath = path.normalize(__dirname + "/.." +
req.url.replace(/\./g, '').split("?")[0]);
res.sendfile(filePath, { maxAge: exports.maxAge }); res.sendfile(filePath, { maxAge: exports.maxAge });
}); });