BreizhHardware/jfa-go
1
0
Fork 0
mirror of https://github.com/hrfee/jfa-go.git synced 2026-01-18 16:47:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

query unescape more routes

Browse Source 
fixes #447. Went through all routes with components in the path to check
if they needed escaping, quite a few did.
This commit is contained in:
Harvey Tindall
2025-12-06 20:04:30 +00:00
parent e5315095be
commit fcfd5f4981
4 changed files with 40 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
api-backups.go
View File

@@ -1,6 +1,7 @@
package main
import (
"net/url"
"os"
"path/filepath"
"sort"
@@ -29,10 +30,15 @@ func (app *appContext) CreateBackup(gc *gin.Context) {
// @Security Bearer
// @tags Backups
func (app *appContext) GetBackup(gc *gin.Context) {
fname := gc.Param("fname")
escapedFName := gc.Param("fname")
fname, err := url.QueryUnescape(escapedFName)
if err != nil {
respondBool(400, false, gc)
return
}
// Hopefully this is enough to ensure the path isn't malicious. Hidden behind bearer auth anyway so shouldn't matter too much I guess.
b := Backup{}
err := b.FromString(fname)
err = b.FromString(fname)
if err != nil || b.Date.IsZero() {
app.debug.Printf(lm.IgnoreInvalidFilename, fname, err)
respondBool(400, false, gc)