This commit is contained in:
parent
dd4fab2a9d
commit
2d9375b9b1
@ -271,7 +271,7 @@ async def handle_upload(request: web.Request):
|
||||
async def handle_thumbnail(request: web.Request):
|
||||
path = request.match_info["path"]
|
||||
|
||||
safe_path = pathlib.Path(path)
|
||||
safe_path = pathlib.Path(request.app.upload_path).joinpath(pathlib.Path(path.name))
|
||||
|
||||
if not safe_path.is_file():
|
||||
return web.Response(status=400, text="Invalid file type.")
|
||||
|
Loading…
Reference in New Issue
Block a user