Merge URI sanitize fix

2011-06-14 16:21:56 +02:00
parent da42112740
commit 00d8b08341
2 changed files with 15 additions and 1 deletions
--- a/radicale/ical.py
+++ b/radicale/ical.py
@ -183,7 +183,8 @@ class Calendar(object):
        The ``path`` is relative to the storage folder.

        """
-        attributes = posixpath.normpath(path.strip("/")).split("/")
+        # First do normpath and then strip, to prevent access to FOLDER/../
+        attributes = posixpath.normpath(path).strip("/").split("/")
        if not attributes:
            return None
        if attributes[-1].endswith(".ics"):