Prevent directory browsing

This commit is contained in:
Luke Pulverenti 2015-05-13 00:16:55 -04:00
parent 1483c3f8fe
commit dca5101e46

View File

@ -102,7 +102,17 @@ namespace MediaBrowser.WebDashboard.Api
/// <returns>System.String.</returns> /// <returns>System.String.</returns>
private string GetDashboardResourcePath(string virtualPath) private string GetDashboardResourcePath(string virtualPath)
{ {
return Path.Combine(DashboardUIPath, virtualPath.Replace('/', Path.DirectorySeparatorChar)); var rootPath = DashboardUIPath;
var fullPath = Path.Combine(rootPath, virtualPath.Replace('/', Path.DirectorySeparatorChar));
// Don't allow file system access outside of the source folder
if (!_fileSystem.ContainsSubPath(rootPath, fullPath))
{
throw new UnauthorizedAccessException();
}
return fullPath;
} }
/// <summary> /// <summary>