benjamyn/paste
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

fixed LFI in reading pastes

Browse Source
This commit is contained in:
Benjamyn Love 2018-12-08 00:36:48 +11:00
parent 7b31c1e512
commit 7468edff86
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
paste.py
View File

@ -10,6 +10,7 @@ pasteDir = Path("pastes")
nameLength = 10 nameLength = 10
useSpecialChars = False useSpecialChars = False
allowListing = False allowListing = False
hostedURL = "http://localhost:5000/"
letters = string.ascii_letters letters = string.ascii_letters
if useSpecialChars: if useSpecialChars:
@ -64,12 +65,14 @@ def index():
name = randomName() name = randomName()
else: else:
writePaste(name, data.decode()) writePaste(name, data.decode())
return "https://paste.benjamyn.love/" + name return hostedURL + name
@app.route('/<path:path>') @app.route('/<path:path>')
def getPaste(path): def getPaste(path):
pasten = pasteDir / path tmpPath = Path(path)
pasten = pasteDir / tmpPath.name
print("Checking " + str(pasten))
if pasten.is_file(): if pasten.is_file():
with pasten.open() as f: data = f.read() with pasten.open() as f: data = f.read()
return data return data