Craftadoc/clsi
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

provide a static server which forbids symlinks

Browse Source 
prevents mismatch between rootdir of server and rootdir of symlink
checking middleware
This commit is contained in:
Brian Gough
2015-02-27 13:57:57 +00:00
parent 0692e964ef
commit 37cc9f3715
4 changed files with 38 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
app/coffee/StaticServerForbidSymlinks.coffee Normal file
View File

@@ -0,0 +1,24 @@
Path = require("path")
fs = require("fs")
Settings = require("settings-sharelatex")
logger = require("logger-sharelatex")
url = require "url"
module.exports = ForbidSymlinks = (staticFn, root, options) ->
expressStatic = staticFn root, options
basePath = Path.resolve(root)
return (req, res, next) ->
path = url.parse(req.url)?.pathname
requestedFsPath = Path.normalize("#{basePath}/#{path}")
fs.realpath requestedFsPath, (err, realFsPath)->
if err?
logger.warn err:err, requestedFsPath:requestedFsPath, realFsPath:realFsPath, path: req.params[0], project_id: req.params.project_id, "error checking file access"
if err.code == 'ENOENT'
return res.sendStatus(404)
else
return res.sendStatus(500)
else if requestedFsPath != realFsPath
logger.warn requestedFsPath:requestedFsPath, realFsPath:realFsPath, path: req.params[0], project_id: req.params.project_id, "trying to access a different file (symlink), aborting"
return res.sendStatus(404)
else
expressStatic(req, res, next)