This commit is contained in:
parent
f8ec8afce7
commit
ee42c6b874
@ -271,7 +271,7 @@ async def handle_upload(request: web.Request):
|
||||
async def handle_thumbnail(request: web.Request):
|
||||
path = request.match_info["path"]
|
||||
|
||||
safe_path = pathlib.Path(request.app.upload_path).joinpath(pathlib.Path(path.name))
|
||||
safe_path = pathlib.Path(request.app.upload_path).joinpath(pathlib.Path(path).name)
|
||||
|
||||
if not safe_path.is_file():
|
||||
return web.Response(status=400, text="Invalid file type.")
|
||||
|
Loading…
Reference in New Issue
Block a user