ChaoticByte/drinks-manager
1
1
Fork 0
Code Issues Pull requests Projects Releases 20 Packages Wiki Activity Actions

The application now correctly encodes the url query string for the profile-picture name (for security reasons), removed a left-over print-statement

Browse source
This commit is contained in:
W13R 2022-11-03 20:45:52 +01:00
parent 9f270c12b4
commit 1e32e2b5dd
3 changed files with 2 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
application/app/templates/registration/login.html
View file

@ -69,7 +69,7 @@
<ul class="userlist"> <ul class="userlist">
{% for user_ in user_list %} {% for user_ in user_list %}
<li class="userlistButton button" data-username="{{ user_.username }}"> <li class="userlistButton button" data-username="{{ user_.username }}">
<img src="{{ '/profilepictures?name='|add:user_.profile_picture_filename }}"> <img src="/profilepictures?name={{ user_.profile_picture_filename|urlencode }}">
<div> <div>
{% if user_.first_name %} {% if user_.first_name %}

2
application/app/templates/userPanel.html
View file

@ -3,7 +3,7 @@
<div class="userPanel"> <div class="userPanel">
<div class="userInfo"> <div class="userInfo">
<img src="{{ '/profilepictures?name='|add:user.profile_picture_filename }}"> <img src="/profilepictures?name={{ user.profile_picture_filename|urlencode }}">
<span> <span>
{% if user.first_name != "" %} {% if user.first_name != "" %}
{% translate "User" %}: {{ user.first_name }} {{ user.last_name }} ({{ user.username }}) {% translate "User" %}: {{ user.first_name }} {{ user.last_name }} ({{ user.username }})

1
application/app/views.py
View file

@ -124,7 +124,6 @@ def redirect_home(request):
def profile_pictures(request): def profile_pictures(request):
if not "name" in request.GET: if not "name" in request.GET:
return HttpResponse(b"", status=400) return HttpResponse(b"", status=400)
print(request.GET["name"])
ppic_filepath = Path(profile_pictures_path / request.GET["name"]).resolve() ppic_filepath = Path(profile_pictures_path / request.GET["name"]).resolve()
try: try:
ppic_filepath.relative_to(profile_pictures_path) ppic_filepath.relative_to(profile_pictures_path)