mirror/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2024-05-11 05:55:29 +00:00
Code Issues Projects Releases Wiki Activity

fix bug on upload file name (#5571)

Browse Source
This commit is contained in:
Lunny Xiao
2018-12-21 10:32:11 +08:00
committed by techknowlogick
parent 7cb1d8296d
commit 4a02a783c4
2 changed files with 48 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
routers/repo/editor.go
View File

@@ -559,6 +559,17 @@ func UploadFilePost(ctx *context.Context, form auth.UploadRepoFileForm) {
ctx.Redirect(ctx.Repo.RepoLink + "/src/branch/" + branchName + "/" + form.TreePath)
}
func cleanUploadFileName(name string) string {
name = strings.TrimLeft(name, "./\\")
name = strings.Replace(name, "../", "", -1)
name = strings.Replace(name, "..\\", "", -1)
name = strings.TrimPrefix(path.Clean(name), ".git/")
if name == ".git" {
return ""
}
return name
}
// UploadFileToServer upload file to server file dir not git
func UploadFileToServer(ctx *context.Context) {
file, header, err := ctx.Req.FormFile("file")
@@ -591,7 +602,13 @@ func UploadFileToServer(ctx *context.Context) {
}
}
upload, err := models.NewUpload(header.Filename, buf, file)
name := cleanUploadFileName(header.Filename)
if len(name) == 0 {
ctx.Error(500, "Upload file name is invalid")
return
}
upload, err := models.NewUpload(name, buf, file)
if err != nil {
ctx.Error(500, fmt.Sprintf("NewUpload: %v", err))
return