diff --git a/truewiki/web_routes.py b/truewiki/web_routes.py index b9f1bdf..6419db6 100644 --- a/truewiki/web_routes.py +++ b/truewiki/web_routes.py @@ -40,6 +40,11 @@ async def wrapper(*args, **kwargs): def _validate_page(page: str) -> None: + # If there is no "/" in the page name, it is a page in the root-folder, + # and that means we don't have to check for directory traversal. + if "/" not in page: + return + filename = os.path.basename(page) path = os.path.normpath(os.path.dirname(page)) fullpath = f"{path}/{filename}"