Display standard http error instead of exception on path security error

This commit is contained in:
shortcutme 2018-06-25 14:28:42 +02:00
parent e1fdb90da6
commit c7a8a3933e
No known key found for this signature in database
GPG Key ID: 5B63BAE6CB9613AE
1 changed files with 1 additions and 1 deletions

View File

@ -85,7 +85,7 @@ class UiRequest(object):
# Sanitize request url
path = path.replace("\\", "/")
if "../" in path or "./" in path:
raise SecurityError("Invalid path")
return self.error403("Invalid path: %s" % path)
if self.env["REQUEST_METHOD"] == "OPTIONS":
if "/" not in path.strip("/"):