mirrors/etherpad-lite
1
0
Fork 0
mirror of https://github.com/ether/etherpad-lite.git synced 2025-04-21 16:06:16 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 26

Fix readOnly pad export

Browse source 
The export request hook wasn't testing if the pad's id was from a read-only
pad before validating with the pad manager.

This includes an extra step that makes the read-only id verification and also
avoids setting the original pad's id as the file's name.
This commit is contained in:
Pedro Beschorner Marin 2020-09-16 14:57:27 -03:00 • committed by John McLear
parent 9f63d9b76a
commit c56973ce74
3 changed files with 27 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

9
src/node/handler/ExportHandler.js
View file

@ -49,9 +49,10 @@ const tempDirectory = os.tmpdir();
/**
* do a requested export
*/
async function doExport(req, res, padId, type)
async function doExport(req, res, padId, readOnlyId, type)
{
var fileName = padId;
// avoid naming the read-only file as the original pad's id
var fileName = readOnlyId ? readOnlyId : padId;
// allow fileName to be overwritten by a hook, the type type is kept static for security reasons
let hookFileName = await hooks.aCallFirst("exportFileName", padId);
@ -130,9 +131,9 @@ async function doExport(req, res, padId, type)
}
}
exports.doExport = function(req, res, padId, type)
exports.doExport = function(req, res, padId, readOnlyId, type)
{
doExport(req, res, padId, type).catch(err => {
doExport(req, res, padId, readOnlyId, type).catch(err => {
if (err !== "stop") {
throw err;
}