diff --git a/CHANGELOG.md b/CHANGELOG.md index 43b4471f..d3134dca 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,7 @@ TBD - Fix colours on public pages. ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/504)) - Fix bug where public background was not sent to public pages...like the error page resulting in an error...ironic...I know. ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/505)) - Be sure a user cannot server import crafty dir. ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/506)) +- Remove Pathlib from sub path check ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/508)) ### Tweaks TBD ### Lang diff --git a/app/classes/shared/helpers.py b/app/classes/shared/helpers.py index c4d9ad10..39b7b12e 100644 --- a/app/classes/shared/helpers.py +++ b/app/classes/shared/helpers.py @@ -376,6 +376,17 @@ class Helpers: return default_return + @staticmethod + def is_subdir(server_path, root_dir): + server_path = os.path.realpath(server_path) + root_dir = os.path.realpath(root_dir) + + relative = os.path.relpath(server_path, root_dir) + + if relative.startswith(os.pardir): + return False + return True + def set_setting(self, key, new_value): try: with open(self.settings_file, "r", encoding="utf-8") as f: diff --git a/app/classes/web/ajax_handler.py b/app/classes/web/ajax_handler.py index 61e2c40d..cdd67146 100644 --- a/app/classes/web/ajax_handler.py +++ b/app/classes/web/ajax_handler.py @@ -508,12 +508,12 @@ class AjaxHandler(BaseHandler): self.redirect("/panel/dashboard") elif page == "unzip_server": - path = urllib.parse.unquote(self.get_argument("path", None)) + path = urllib.parse.unquote(self.get_argument("path", "")) if not path: path = os.path.join( self.controller.project_root, "imports", - self.get_argument("file", ""), + urllib.parse.unquote(self.get_argument("file", "")), ) if Helpers.check_file_exists(path): self.helper.unzip_server(path, exec_user["user_id"]) diff --git a/app/classes/web/server_handler.py b/app/classes/web/server_handler.py index f17c7753..62c549e5 100644 --- a/app/classes/web/server_handler.py +++ b/app/classes/web/server_handler.py @@ -2,7 +2,6 @@ import json import logging import os import time -from pathlib import Path import tornado.web import tornado.escape import bleach @@ -320,13 +319,6 @@ class ServerHandler(BaseHandler): return import_type = bleach.clean(self.get_argument("create_type", "")) import_server_path = bleach.clean(self.get_argument("server_path", "")) - if Path(self.controller.project_root).is_relative_to(import_server_path): - self.redirect( - "/panel/error?error=Loop Error: The selected path will cause" - " an infinite copy loop. Make sure Crafty's directory is not" - " in your server path." - ) - return import_server_jar = bleach.clean(self.get_argument("server_jar", "")) server_parts = server.split("|") captured_roles = [] @@ -339,6 +331,15 @@ class ServerHandler(BaseHandler): return if import_type == "import_jar": + if not self.helper.is_subdir( + import_server_path, self.controller.project_root + ): + self.redirect( + "/panel/error?error=Loop Error: The selected path will cause" + " an infinite copy loop. Make sure Crafty's directory is not" + " in your server path." + ) + return good_path = self.controller.verify_jar_server( import_server_path, import_server_jar ) @@ -476,13 +477,6 @@ class ServerHandler(BaseHandler): return import_type = bleach.clean(self.get_argument("create_type", "")) import_server_path = bleach.clean(self.get_argument("server_path", "")) - if Path(self.controller.project_root).is_relative_to(import_server_path): - self.redirect( - "/panel/error?error=Loop Error: The selected path will cause" - " an infinite copy loop. Make sure Crafty's directory is not" - " in your server path." - ) - return import_server_exe = bleach.clean(self.get_argument("server_jar", "")) server_parts = server.split("|") captured_roles = [] @@ -495,6 +489,15 @@ class ServerHandler(BaseHandler): return if import_type == "import_jar": + if self.helper.is_subdir( + import_server_path, self.controller.project_root + ): + self.redirect( + "/panel/error?error=Loop Error: The selected path will cause" + " an infinite copy loop. Make sure Crafty's directory is not" + " in your server path." + ) + return good_path = self.controller.verify_jar_server( import_server_path, import_server_exe )