Merge branch 'bug/import-dir-check' into 'dev'

Remove Pathlib from sub path check

See merge request crafty-controller/crafty-4!507

CHANGELOG.md

@@ -8,6 +8,7 @@ TBD
 - Fix colours on public pages. ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/504))
 - Fix bug where public background was not sent to public pages...like the error page resulting in an error...ironic...I know. ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/505))
 - Be sure a user cannot server import crafty dir. ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/506))
+- Remove Pathlib from sub path check ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/508))
 ### Tweaks
 TBD
 ### Lang

app/classes/shared/helpers.py

@@ -376,6 +376,17 @@ class Helpers:
 
         return default_return
 
+    @staticmethod
+    def is_subdir(server_path, root_dir):
+        server_path = os.path.realpath(server_path)
+        root_dir = os.path.realpath(root_dir)
+
+        relative = os.path.relpath(server_path, root_dir)
+
+        if relative.startswith(os.pardir):
+            return False
+        return True
+
     def set_setting(self, key, new_value):
         try:
             with open(self.settings_file, "r", encoding="utf-8") as f:

app/classes/web/ajax_handler.py

@@ -508,12 +508,12 @@ class AjaxHandler(BaseHandler):
                     self.redirect("/panel/dashboard")
 
         elif page == "unzip_server":
-            path = urllib.parse.unquote(self.get_argument("path", None))
+            path = urllib.parse.unquote(self.get_argument("path", ""))
             if not path:
                 path = os.path.join(
                     self.controller.project_root,
                     "imports",
-                    self.get_argument("file", ""),
+                    urllib.parse.unquote(self.get_argument("file", "")),
                 )
             if Helpers.check_file_exists(path):
                 self.helper.unzip_server(path, exec_user["user_id"])

app/classes/web/server_handler.py

@@ -2,7 +2,6 @@ import json
 import logging
 import os
 import time
-from pathlib import Path
 import tornado.web
 import tornado.escape
 import bleach
@@ -320,13 +319,6 @@ class ServerHandler(BaseHandler):
                 return
             import_type = bleach.clean(self.get_argument("create_type", ""))
             import_server_path = bleach.clean(self.get_argument("server_path", ""))
-            if Path(self.controller.project_root).is_relative_to(import_server_path):
-                self.redirect(
-                    "/panel/error?error=Loop Error: The selected path will cause"
-                    " an infinite copy loop. Make sure Crafty's directory is not"
-                    " in your server path."
-                )
-                return
             import_server_jar = bleach.clean(self.get_argument("server_jar", ""))
             server_parts = server.split("|")
             captured_roles = []
@@ -339,6 +331,15 @@ class ServerHandler(BaseHandler):
                 return
 
             if import_type == "import_jar":
+                if not self.helper.is_subdir(
+                    import_server_path, self.controller.project_root
+                ):
+                    self.redirect(
+                        "/panel/error?error=Loop Error: The selected path will cause"
+                        " an infinite copy loop. Make sure Crafty's directory is not"
+                        " in your server path."
+                    )
+                    return
                 good_path = self.controller.verify_jar_server(
                     import_server_path, import_server_jar
                 )
@@ -476,13 +477,6 @@ class ServerHandler(BaseHandler):
                 return
             import_type = bleach.clean(self.get_argument("create_type", ""))
             import_server_path = bleach.clean(self.get_argument("server_path", ""))
-            if Path(self.controller.project_root).is_relative_to(import_server_path):
-                self.redirect(
-                    "/panel/error?error=Loop Error: The selected path will cause"
-                    " an infinite copy loop. Make sure Crafty's directory is not"
-                    " in your server path."
-                )
-                return
             import_server_exe = bleach.clean(self.get_argument("server_jar", ""))
             server_parts = server.split("|")
             captured_roles = []
@@ -495,6 +489,15 @@ class ServerHandler(BaseHandler):
                 return
 
             if import_type == "import_jar":
+                if self.helper.is_subdir(
+                    import_server_path, self.controller.project_root
+                ):
+                    self.redirect(
+                        "/panel/error?error=Loop Error: The selected path will cause"
+                        " an infinite copy loop. Make sure Crafty's directory is not"
+                        " in your server path."
+                    )
+                    return
                 good_path = self.controller.verify_jar_server(
                     import_server_path, import_server_exe
                 )