summaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/WebAdmin.cpp17
1 files changed, 8 insertions, 9 deletions
diff --git a/src/WebAdmin.cpp b/src/WebAdmin.cpp
index 335b6b94e..9082044fa 100644
--- a/src/WebAdmin.cpp
+++ b/src/WebAdmin.cpp
@@ -375,14 +375,13 @@ void cWebAdmin::HandleFileRequest(cHTTPServerConnection & a_Connection, cHTTPInc
}
}
- // Remove all "../" strings:
- ReplaceString(FileURL, "../", "");
-
// Read the file contents and guess its mime-type, based on the extension:
AString Content = "<h2>404 Not Found</h2>";
- AString ContentType;
+ AString ContentType = "text/html";
AString Path = Printf(FILE_IO_PREFIX "webadmin/files/%s", FileURL.c_str());
- if (cFile::IsFile(Path))
+
+ // Return 404 if the file is not found, or the URL contains '../' (for security reasons)
+ if ((FileURL.find("../") == AString::npos) && cFile::IsFile(Path))
{
cFile File(Path, cFile::fmRead);
AString FileContent;
@@ -395,10 +394,10 @@ void cWebAdmin::HandleFileRequest(cHTTPServerConnection & a_Connection, cHTTPInc
ContentType = GetContentTypeFromFileExt(Path.substr(LastPointPosition + 1));
}
}
- }
- if (ContentType.empty())
- {
- ContentType = "application/unknown";
+ if (ContentType.empty())
+ {
+ ContentType = "application/unknown";
+ }
}
// Send the response: