CVE-2023-28459: Fix path traversal in static HTML export · pretalx/pretalx@60722c4

@@ -115,7 +115,9 @@ def dump_content(destination, path, getter): if path.endswith(“/”): path = path + “index.html”
path = Path(destination) / path.lstrip(“/”) path = (Path(destination) / path.lstrip(“/”)).resolve() if not Path(destination) in path.parents: raise CommandError(“Path traversal detected, aborting.”) path.parent.mkdir(parents=True, exist_ok=True)
with open(path, “wb”) as f: @@ -131,6 +133,14 @@ def get_mediastatic_content(url): else: raise FileNotFoundError()
# Prevent directory traversal, make sure the path is inside the media or static root local_path = local_path.resolve(strict=True) if not any( path in local_path.parents for path in (settings.MEDIA_ROOT, settings.STATIC_ROOT) ): raise FileNotFoundError()
with open(local_path, “rb”) as f: return f.read()