change regex checking file request ensure other files can not be accessed

This commit is contained in:
Henry Oswald
2015-05-12 15:17:18 +01:00
parent 9d3fdcf8b4
commit 94c4187eb2
2 changed files with 13 additions and 2 deletions

View File

@@ -9,8 +9,8 @@ module.exports = ForbidSymlinks = (staticFn, root, options) ->
basePath = Path.resolve(root)
return (req, res, next) ->
path = url.parse(req.url)?.pathname
# check that the path is of the form /project_id/path/to/file
if result = path.match(/^\/?(\w+)\/(.*)/)
# check that the path is of the form /project_id_or_name/path/to/file.log
if result = path.match(/^\/?([a-zA-Z0-9_-]+)\/(.*)/)
project_id = result[1]
file = result[2]
else