Clean many, many things

This commit is contained in:
Guillaume Ayoub
2016-08-05 02:14:49 +02:00
parent 263f31c84b
commit 8ac3ce1a89
5 changed files with 240 additions and 239 deletions

View File

@ -111,7 +111,7 @@ class Rights(BaseRights):
user = user or ""
if user and not storage.is_safe_path_component(user):
# Prevent usernames like "user/calendar.ics"
raise ValueError("Unsafe username")
raise ValueError("Refused unsafe username: %s", user)
sane_path = storage.sanitize_path(path).strip("/")
# Prevent "regex injection"
user_escaped = re.escape(user)