LAB-linuxserver/core
1
0
Fork 0
mirror of https://github.com/linuxserver/core.git synced 2026-02-20 05:07:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request +13343 from c9/standalone-fix-security-m10

Browse Source 
sanitize path from URL
This commit is contained in:
Fabian Jakobs 2016-04-11 15:32:19 +02:00
commit 2433da1f70
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
plugins/c9.vfs.standalone/standalone.js
View File

@ -176,7 +176,7 @@ function plugin(options, imports, register) {
api.get("/update/:path*", function(req, res, next) {
var filename = req.params.path;
var path = resolve(__dirname + "/../../build/output/" + filename);
var path = resolve(__dirname + "/../../build/output/" + resolve("/" + filename));
var stream = fs.createReadStream(path);
stream.on("error", function(err) {