Changeset 756:8745488a7e28 in hatta-dev

Timestamp:

02/10/10 21:36:13 (2 years ago)

Author:

sheep@…

Branch:

default

Message:

make sure to escape Windows special filenames and unix dotfiles

Files:

• hatta.py (modified) (3 diffs)
• tests/test_repo.py (modified) (1 diff)

hatta.py

@@ -383 +383 @@
         return path
 
-
     def _check_path(self, path):
         """
@@ -391 +390 @@
         abspath = os.path.abspath(path)
         if os.path.islink(path) or os.path.isdir(path):
-            raise werkzeug.exceptions.Forbidden(_(u"Can't use symbolic links or directories as pages"))
+            raise werkzeug.exceptions.Forbidden(
+                _(u"Can't use symbolic links or directories as pages"))
         if not abspath.startswith(self.path):
-            raise werkzeug.exceptions.Forbidden(_(u"Can't read or write outside of the pages repository"))
-
+            raise werkzeug.exceptions.Forbidden(
+                _(u"Can't read or write outside of the pages repository"))
 
     def _file_path(self, title):
@@ -401 +401 @@
     def _title_to_file(self, title):
         title = unicode(title).strip()
-        return os.path.join(self.repo_prefix,
-                            werkzeug.url_quote(title, safe=''))
-
-    def _file_to_title(self, filename):
-        assert filename.startswith(self.repo_prefix)
-        name = filename[len(self.repo_prefix):].strip('/')
+        filename = werkzeug.url_quote(title, safe='')
+        # Escape special windows filenames and dot files
+        _windows_device_files = ('CON', 'AUX', 'COM1', 'COM2', 'COM3',
+                                 'COM4', 'LPT1', 'LPT2', 'LPT3', 'PRN',
+                                 'NUL')
+        if (filename.split('.')[0].upper() in _windows_device_files or
+            filename.startswith('_') or filename.startswith('.')):
+            filename = '_' + filename
+        return os.path.join(self.repo_prefix, filename)
+
+    def _file_to_title(self, filepath):
+        if not filepath.startswith(self.repo_prefix):
+            raise werkzeug.exceptions.Forbidden(
+                _(u"Can't read or write outside of the pages repository"))
+        name = filepath[len(self.repo_prefix):].strip('/')
+        # Unescape special windows filenames and dot files
+        if name.startswith('_') and len(name)>1:
+            name = name[1:]
         return werkzeug.url_unquote(name)
 

tests/test_repo.py

@@ -155 +155 @@
 
         title = u'../some/+s page/ąęść?.txt'
-        filename = '..%2Fsome%2F%2Bs%20page%2F%C4%85%C4%99%C5%9B%C4%87%3F.txt'
+        filename = '_..%2Fsome%2F%2Bs%20page%2F%C4%85%C4%99%C5%9B%C4%87%3F.txt'
         filepath = os.path.join(repo.path, filename)
         repo.save_text(title, self.text, self.author, self.comment, parent=-1)