opensource/galaxy
3
0
Fork 0
mirror of https://github.com/galaxyproject/galaxy.git synced 2026-09-24 16:30:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #9411 from dannon/fix_shed_image_resolution

Browse Source 
[20.01] Fix shed image resolution
This commit is contained in:
Marius van den Beek
2020-02-24 10:51:08 +01:00
committed by GitHub
parent a2b8f48310 6ed152d976
commit 2c4da06d7a
1 changed files with 26 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/galaxy/webapps/galaxy/controllers/shed_tool_static.py
+26 -12
View File
@@ -9,6 +9,12 @@ from galaxy.webapps.base.controller import BaseUIController
log = logging.getLogger(__name__)
def _asset_exists_and_is_safe(repo_path, asset_path):
if not safe_contains(repo_path, asset_path):
raise RequestParameterInvalidException()
return os.path.exists(asset_path)
class ShedToolStatic(BaseUIController):
@web.expose
@@ -26,17 +32,25 @@ class ShedToolStatic(BaseUIController):
"""
guid = '/'.join([shed, 'repos', owner, repo, tool, version])
tool = trans.app.toolbox.get_tool(guid)
repo_path = tool._repository_dir
if 'static/images' not in image_file:
path = join(repo_path, 'static', 'images', image_file)
repo_path = os.path.abspath(tool._repository_dir)
asset_path = os.path.abspath(join(repo_path, image_file))
# test specified image_file path exactly first, then fail through to
# other locations.
# Might want to swap this around and check for static/images first if
# that's the new(?) standard.
if not _asset_exists_and_is_safe(repo_path, asset_path):
if 'static/images' not in image_file:
asset_path = join(repo_path, 'static', 'images', image_file)
if not _asset_exists_and_is_safe(repo_path, asset_path):
asset_path = None
if asset_path:
ext = os.path.splitext(image_file)[-1].lstrip('.')
if ext:
mime = trans.app.datatypes_registry.get_mimetype_by_extension(ext)
if mime:
trans.response.set_content_type(mime)
return open(asset_path, 'rb')
else:
path = join(repo_path, image_file)
if not safe_contains(os.path.abspath(repo_path), os.path.abspath(path)):
raise RequestParameterInvalidException()
ext = os.path.splitext(image_file)[-1].lstrip('.')
if ext:
mime = trans.app.datatypes_registry.get_mimetype_by_extension(ext)
if mime:
trans.response.set_content_type(mime)
if os.path.exists(path):
return open(path, 'rb')