fork/cellxgene-gateway
1
0
Fork 0
mirror of https://github.com/Novartis/cellxgene-gateway.git synced 2026-10-11 02:00:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

#5 added os.path.join to flask routes

Browse Source 
Also added a subdir check for security.
This commit is contained in:
Alok Saldanha
2019-09-19 12:54:26 -04:00
parent b5158dee47
commit 6cf953aaab
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cellxgene_gateway/gateway.py
+4 -4
View File
@@ -26,7 +26,7 @@ from werkzeug import secure_filename
from cellxgene_gateway import env from cellxgene_gateway import env
from cellxgene_gateway.backend_cache import BackendCache from cellxgene_gateway.backend_cache import BackendCache
from cellxgene_gateway.cellxgene_exception import CellxgeneException from cellxgene_gateway.cellxgene_exception import CellxgeneException
from cellxgene_gateway.dir_util import create_dir, recurse_dir, render_entries from cellxgene_gateway.dir_util import create_dir, recurse_dir, render_entries, is_subdir
from cellxgene_gateway.extra_scripts import get_extra_scripts from cellxgene_gateway.extra_scripts import get_extra_scripts
from cellxgene_gateway.path_util import get_dataset, get_file_path from cellxgene_gateway.path_util import get_dataset, get_file_path
from cellxgene_gateway.process_exception import ProcessException from cellxgene_gateway.process_exception import ProcessException
@@ -125,14 +125,14 @@ def make_subdir():
def upload_file(): def upload_file():
upload_dir = request.form["path"] upload_dir = request.form["path"]
full_upload_path = env.cellxgene_data + "/" + upload_dir full_upload_path = os.path.join(env.cellxgene_data, upload_dir)
if os.path.isdir(full_upload_path): if is_subdir(full_upload_path, env.cellxgene_data) and os.path.isdir(full_upload_path):
if request.method == "POST": if request.method == "POST":
if "file" in request.files: if "file" in request.files:
f = request.files["file"] f = request.files["file"]
if f and f.filename.endswith(".h5ad"): if f and f.filename.endswith(".h5ad"):
f.save( f.save(
full_upload_path + "/" + secure_filename(f.filename) os.path.join(full_upload_path, secure_filename(f.filename))
) )
return redirect("/filecrawl.html", code=302) return redirect("/filecrawl.html", code=302)
else: else: