zefie/minisrv
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix security issue with favorites

Browse Source
This commit is contained in:
zefie
2022-11-23 23:45:48 -05:00
parent 47919cfb4b
commit 76d0720727
2 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
zefie_wtvp_minisrv/ServiceVault/wtv-favorite/commit-add-folder.js
View File

@@ -14,17 +14,17 @@ if (foldername)
{ {
if (folder_array.length < minisrv_config.services[service_name].max_folders) if (folder_array.length < minisrv_config.services[service_name].max_folders)
{ {
//if (session_data.favstore.checkFolderName(foldername) == true) if (session_data.favstore.checkFolderName(foldername) == true)
//{ {
session_data.favstore.createFolder(foldername); session_data.favstore.createFolder(foldername);
headers = `300 OK headers = `300 OK
Connection: Keep-Alive Connection: Keep-Alive
Content-Type: text/html Content-Type: text/html
Location: wtv-favorite:/favorite Location: wtv-favorite:/favorite
wtv-expire-all: wtv-favorite:` wtv-expire-all: wtv-favorite:`
//} else { } else {
// headers = `400 That folder name is not valid. Choose a different name and try again.` headers = `400 That folder name is not valid. Choose a different name and try again.`
//} }
} else { } else {
headers = `400 You can only have ${minisrv_config.services[service_name].max_folders} folders at one time. Delete some folders and try again.` headers = `400 You can only have ${minisrv_config.services[service_name].max_folders} folders at one time. Delete some folders and try again.`
} }

8
zefie_wtvp_minisrv/includes/WTVFavorites.js
View File

@@ -75,6 +75,14 @@ class WTVFavorites {
return store_dir; return store_dir;
} }
checkFolderName(foldername) {
var regex_str = "^([A-Za-z0-9\-\_]{1,}$";
var regex = new RegExp(regex_str);
return regex.test(foldername);
}
createTemplateFolder(folder) { createTemplateFolder(folder) {
// create emply folder // create emply folder
this.createFolder(folder) this.createFolder(folder)