From a9b15fe57aee536fe9f3728bdab4af784bc28ce7 Mon Sep 17 00:00:00 2001 From: Patric Stout Date: Sun, 22 Nov 2020 14:39:42 +0100 Subject: [PATCH] Fix: return normal error pages when people visit /NNN --- truewiki/web_routes.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/truewiki/web_routes.py b/truewiki/web_routes.py index b9f1bdf..6419db6 100644 --- a/truewiki/web_routes.py +++ b/truewiki/web_routes.py @@ -40,6 +40,11 @@ async def wrapper(*args, **kwargs): def _validate_page(page: str) -> None: + # If there is no "/" in the page name, it is a page in the root-folder, + # and that means we don't have to check for directory traversal. + if "/" not in page: + return + filename = os.path.basename(page) path = os.path.normpath(os.path.dirname(page)) fullpath = f"{path}/{filename}"