Changeset 742:bc689845bdd9 in hatta-dev

Timestamp:

01/24/10 14:28:38 (2 years ago)

Author:

sheep@…

Branch:

default

Message:

put the checks in one place

File:

• hatta.py (modified) (5 diffs)

hatta.py

@@ -306 +306 @@
 
         self.charset = charset or 'utf-8'
-        self.path = path
+        self.path = os.path.abspath(path)
         if not os.path.exists(self.path):
             os.makedirs(self.path)
@@ -356 +356 @@
         return path
 
+
+    def _check_path(self, path):
+        """
+        Ensure that the path is within allowed bounds.
+        """
+
+        abspath = os.path.abspath(path)
+        if os.path.islink(path) or os.path.isdir(path):
+            raise werkzeug.exceptions.Forbidden(_(u"Can't use symbolic links or directories as pages"))
+        if not abspath.startswith(self.path):
+            raise werkzeug.exceptions.Forbidden(_(u"Can't read or write outside of the pages repository"))
+
     def _file_path(self, title):
         title = unicode(title).strip()
@@ -413 +425 @@
         repo_file = self._title_to_file(title)
         file_path = self._file_path(title)
-        if os.path.islink(file_path) or os.path.isdir(file_path):
-            raise werkzeug.exceptions.Forbidden(_(u"Can't edit symbolic links or directories"))
+        self._check_path(file_path)
         mercurial.util.rename(file_name, file_path)
         changectx = self._changectx()
@@ -484 +495 @@
         repo_file = self._title_to_file(title)
         file_path = self._file_path(title)
-        if os.path.islink(file_path) or os.path.isdir(file_path):
-            raise werkzeug.exceptions.Forbidden(_(u"Can't edit symbolic links or directories"))
+        self._check_path(file_path)
         try:
             os.unlink(file_path)
@@ -497 +507 @@
 
         file_path = self._file_path(title)
-        if os.path.islink(file_path) or os.path.isdir(file_path):
-            raise werkzeug.exceptions.Forbidden(_(u"Can't read symbolic links or directories"))
+        self._check_path(file_path)
         try:
             return open(file_path, "rb")