This commit is contained in:
parent
dd4fab2a9d
commit
2d9375b9b1
@ -271,7 +271,7 @@ async def handle_upload(request: web.Request):
|
|||||||
async def handle_thumbnail(request: web.Request):
|
async def handle_thumbnail(request: web.Request):
|
||||||
path = request.match_info["path"]
|
path = request.match_info["path"]
|
||||||
|
|
||||||
safe_path = pathlib.Path(path)
|
safe_path = pathlib.Path(request.app.upload_path).joinpath(pathlib.Path(path.name))
|
||||||
|
|
||||||
if not safe_path.is_file():
|
if not safe_path.is_file():
|
||||||
return web.Response(status=400, text="Invalid file type.")
|
return web.Response(status=400, text="Invalid file type.")
|
||||||
|
Loading…
Reference in New Issue
Block a user