server: torrents: ensure path is allowed when mediainfo is requested

2026-06-04 03:27:15 +00:00 · 2020-12-06 21:52:44 +08:00
parent f0b9ca4e2c
commit ebb4927b74
1 changed files with 3 additions and 0 deletions
@@ -668,6 +668,9 @@ router.get('/:hash/mediainfo', async (req, res) => {
  }

  const contentPath = fs.existsSync(path.join(directory, name)) ? path.join(directory, name) : directory;
+  if (!isAllowedPath(contentPath)) {
+    callback(null, accessDeniedError());
+  }

  try {
    const mediainfoProcess = childProcess.execFile(