The application now correctly encodes the url query string for the profile-picture name (for security reasons), removed a left-over print-statement

This commit is contained in:
W13R 2022-11-03 20:45:52 +01:00
parent 9f270c12b4
commit 1e32e2b5dd
3 changed files with 2 additions and 3 deletions

View file

@ -124,7 +124,6 @@ def redirect_home(request):
def profile_pictures(request):
if not "name" in request.GET:
return HttpResponse(b"", status=400)
print(request.GET["name"])
ppic_filepath = Path(profile_pictures_path / request.GET["name"]).resolve()
try:
ppic_filepath.relative_to(profile_pictures_path)