tobias/radicale
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

assert sanitized and stripped paths

Browse Source
This commit is contained in:
Unrud
2018-08-28 16:19:50 +02:00
parent c08754cf92
commit 5429f5c1a9
19 changed files with 108 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
radicale/rights/authenticated.py
View File

@@ -27,7 +27,7 @@ class Rights(rights.BaseRights):
def authorized(self, user, path, permissions):
if self._verify_user and not user:
return ""
sane_path = pathutils.sanitize_path(path).strip("/")
sane_path = pathutils.strip_path(path)
if "/" not in sane_path:
return rights.intersect_permissions(permissions, "RW")
if sane_path.count("/") == 1:

2
radicale/rights/from_file.py
View File

@@ -30,7 +30,7 @@ class Rights(rights.BaseRights):
def authorized(self, user, path, permissions):
user = user or ""
sane_path = pathutils.sanitize_path(path).strip("/")
sane_path = pathutils.strip_path(path)
# Prevent "regex injection"
user_escaped = re.escape(user)
sane_path_escaped = re.escape(sane_path)

2
radicale/rights/owner_only.py
View File

@@ -23,7 +23,7 @@ class Rights(authenticated.Rights):
def authorized(self, user, path, permissions):
if self._verify_user and not user:
return ""
sane_path = pathutils.sanitize_path(path).strip("/")
sane_path = pathutils.strip_path(path)
if not sane_path:
return rights.intersect_permissions(permissions, "R")
if self._verify_user and user != sane_path.split("/", maxsplit=1)[0]:

2
radicale/rights/owner_write.py
View File

@@ -23,7 +23,7 @@ class Rights(authenticated.Rights):
def authorized(self, user, path, permissions):
if self._verify_user and not user:
return ""
sane_path = pathutils.sanitize_path(path).strip("/")
sane_path = pathutils.strip_path(path)
if not sane_path:
return rights.intersect_permissions(permissions, "R")
if self._verify_user: