rpms / python-cherrypy

Clone
Source Code
GIT

Blame cherrypy-2.2.1-security-sessionfilter.patch

el4 el5 el6 epel7 epel8 epel8-playground epel9 f10 f11 f12 f13 f14 f15 f16 f17 f18 f19 f20 f21 f22 f23 f24 f25 f26 f27 f28 f29 f30 f31 f32 f33 f34 f35 f36 f37 f38 f39 f40 f7 f8 f9 fc6 main rawhide
  1.   d627a77be0368bc636ee571664bf064f2912c27e
  2.   cherrypy-2.2.1-security-sessionfilter.patch
Blob History Raw
e204d58 
diff -up CherryPy-2.2.1/cherrypy/filters/sessionfilter.py.sessionfix CherryPy-2.2.1/cherrypy/filters/sessionfilter.py
e204d58 
--- CherryPy-2.2.1/cherrypy/filters/sessionfilter.py.sessionfix	2008-01-06 08:54:39.000000000 -0800
e204d58 
+++ CherryPy-2.2.1/cherrypy/filters/sessionfilter.py	2008-01-06 08:55:31.000000000 -0800
e204d58 
@@ -326,6 +326,8 @@ class FileStorage:
e204d58 
             raise SessionStoragePathNotConfiguredError()
e204d58 
         fileName = self.SESSION_PREFIX + id
e204d58 
         file_path = os.path.join(storage_path, fileName)
e204d58 
+        if not os.path.normpath(filePath).startswith(storagePath):
e204d58 
+            raise cherrypy.HTTPError(400, "Invalid session id in cookie.")
e204d58 
         return file_path
e204d58
e204d58 
     def _lock_file(self, path):
Powered by Pagure 5.14.1
Documentation • File an Issue • About this Instance • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.