hoangvv/NextZen-UserService
1
0
Fork 0
mirror of https://github.com/KaySar12/NextZen-UserService.git synced 2025-10-06 19:59:42 +07:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request from GHSA-h5gf-cmm8-cg7c

Browse Source
This commit is contained in:
link
2024-02-04 11:08:01 +08:00
committed by GitHub
parent 4d2b65e34c
commit 3f4558e23c
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
route/v1/user.go
+11
View File
@@ -13,6 +13,7 @@ import (
"os" "os"
"path" "path"
"path/filepath" "path/filepath"
"regexp"
"strconv" "strconv"
"strings" "strings"
"time" "time"
@@ -667,6 +668,16 @@ func GetUserImage(c *gin.Context) {
return return
} }
matched, err := regexp.MatchString(`^/var/lib/casaos/\d`, filePath)
if err != nil {
c.JSON(http.StatusNotFound, model.Result{Success: common_err.INSUFFICIENT_PERMISSIONS, Message: common_err.GetMsg(common_err.INSUFFICIENT_PERMISSIONS)})
return
}
if !matched {
c.JSON(http.StatusNotFound, model.Result{Success: common_err.INSUFFICIENT_PERMISSIONS, Message: common_err.GetMsg(common_err.INSUFFICIENT_PERMISSIONS)})
return
}
fileTmp, _ := os.Open(filePath) fileTmp, _ := os.Open(filePath)
defer fileTmp.Close() defer fileTmp.Close()