Changeset 1983

Show
Ignore:
Timestamp:
02/16/07 03:17:37 (2 years ago)
Author:
cboos
Message:

DoxygenPlugin:

Tentative fix for the #951 / #1212 security issue with doxygen.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • doxygenplugin/0.10/doxygentrac/doxygentrac.py

    r1251 r1983  
    133133                self.log.warn("redirect without link") 
    134134 
     135        if req.path_info == '/doxygen': 
     136            req.redirect(req.href.doxygen('/')) 
     137 
    135138        # Handle /doxygen request 
    136139        if action == 'index': 
    …… 
    150153            path = os.path.join(self.base_path, self.default_doc, 
    151154                                self.html_output, self.index) 
    152  
    153         # view  
     155        # security check 
     156        path = os.path.abspath(path) 
     157        if not path.startswith(self.base_path): 
     158            raise TracError("Can't access paths outside of " + self.base_path) 
     159 
     160        # view 
    154161        mimetype = mimetypes.guess_type(path)[0] 
    155162        if mimetype == 'text/html':