opensource/galaxy
3
0
Fork 0
mirror of https://github.com/galaxyproject/galaxy.git synced 2026-09-24 16:30:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'upstream/release_22.01' into release_22.05

Browse Source
This commit is contained in:
Dannon Baker
2022-12-05 14:36:31 -05:00
parent 02ff6ff7b4 e5e6bda4f0
commit 1482c2be37
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/galaxy/web/framework/middleware/static.py
+5 -1
View File
@@ -40,7 +40,11 @@ class CacheableStaticURLParser(StaticURLParser):
directory = host_val
break
full = os.path.join(directory, filename)
full = self.normpath(os.path.join(directory, filename))
if not full.startswith(directory):
# Out of bounds
return self.not_found(environ, start_response)
if not os.path.exists(full):
return self.not_found(environ, start_response)
if os.path.isdir(full):