cangui/shelfy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

up

Browse Source
This commit is contained in:
cangui 2025-06-20 18:23:10 +02:00
parent 16a484a142
commit e5e0c21cb8
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
renders/renders.go
View File

@ -664,20 +664,27 @@ func DetailHandler(w http.ResponseWriter, r *http.Request) {
base := "/app/uploads" base := "/app/uploads"
rel := r.URL.Query().Get("path") rel := r.URL.Query().Get("path")
log.Printf("Reçu path: %q", rel)
// On sécurise : supprime les éventuels chemins relatifs // On sécurise : supprime les éventuels chemins relatifs
rel = filepath.Clean("/" + rel) // ça supprime .. etc. rel = filepath.Clean("/" + rel) // ça supprime .. etc.
rel = strings.TrimPrefix(rel, "/") rel = strings.TrimPrefix(rel, "/")
log.Printf("Path nettoyé (rel): %q", rel)
absPath := filepath.Join(base, rel) absPath := filepath.Join(base, rel)
log.Printf("Chemin absolu construit (absPath): %q", absPath)
info, err := os.Stat(absPath) info, err := os.Stat(absPath)
if err != nil { if err != nil {
log.Printf("Erreur os.Stat: %v", err)
http.NotFound(w, r) http.NotFound(w, r)
return return
} }
// Protection : vérifier qu'on reste bien dans base // Protection : vérifier qu'on reste bien dans base
if !strings.HasPrefix(absPath, base) { if !strings.HasPrefix(absPath, base) {
log.Printf("Sécurité: chemin hors du base: %q", absPath)
http.NotFound(w, r) http.NotFound(w, r)
return return
} }
@ -690,6 +697,8 @@ func DetailHandler(w http.ResponseWriter, r *http.Request) {
Size: info.Size(), Size: info.Size(),
} }
log.Printf("Entrée trouvée: %+v", entry)
renderPartial(w, "_file_detail", map[string]interface{}{ renderPartial(w, "_file_detail", map[string]interface{}{
"Entry": entry, "Entry": entry,
}) })