diff --git a/sylk/applications/conference/web.py b/sylk/applications/conference/web.py
index 3856fd9..e101c16 100644
--- a/sylk/applications/conference/web.py
+++ b/sylk/applications/conference/web.py
@@ -1,85 +1,87 @@
# Copyright (C) 2011 AG Projects. See LICENSE for details
#
__all__ = ['ScreenSharingWebServer']
import os
import urllib
from twisted.web import server, static, resource
from twisted.internet import reactor
html_template = """
SylkServer Screen Sharing
"""
class ScreenSharingWebsite(resource.Resource):
isLeaf = True
def __init__(self, path):
- self.base_path = path
+ self.base_path = os.path.realpath(path)
resource.Resource.__init__(self)
def render_GET(self, request):
if 'image' not in request.args or not request.args.get('image', [''])[0].endswith('jpg'):
return "Screenshot image not provided"
image_path = urllib.unquote(request.args['image'][0])
+ if os.path.commonprefix([os.path.realpath(os.path.join(self.base_path, image_path)), self.base_path]) != self.base_path:
+ return "Screenshot image is not readable"
if not os.path.isfile(os.path.join(self.base_path, image_path)):
return "Screenshot image is not readable"
image = os.path.join('/img', image_path)
width = 'width: 100%' if 'fit' in request.args else ''
return html_template % dict(image=image, width=width)
class ScreenSharingWebServer(object):
def __init__(self, images_path):
root = resource.Resource()
home = ScreenSharingWebsite(images_path)
img_resource = static.File(images_path)
root.putChild('', home)
root.putChild('img', img_resource)
self.site = server.Site(root, logPath=os.devnull)
self.listener = None
@property
def port(self):
if self.listener is None:
return 0
return self.listener.getHost().port
def run(self, interface, port):
self.listener = reactor.listenTCP(port, self.site, interface=interface)