github/cosin
1
0
Fork 0
mirror of https://github.com/chatopera/cosin.git synced 2025-08-01 16:38:02 +08:00
Code Issues Releases Wiki Activity

Merge pull request #1010 from Necromone/develop

Browse Source 
fix 任意文件读取
This commit is contained in:
lecjy 2024-03-23 10:27:48 +08:00 committed by GitHub
commit a8af534129
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
contact-center/app/src/main/java/com/cskefu/cc/controller/resource/MediaController.java
View File

@ -166,7 +166,7 @@ public class MediaController extends Handler {
@RequestMapping("/template")
@Menu(type = "resouce", subtype = "template")
public void template(HttpServletResponse response, HttpServletRequest request, @Valid String filename) throws IOException {
if (StringUtils.isNotBlank(filename)) {
if (StringUtils.isNotBlank(filename) && !(filename.contains("../") || filename.contains("..\\"))) {
InputStream is = MediaController.class.getClassLoader().getResourceAsStream(TEMPLATE_DATA_PATH + filename);
if (is != null) {
response.setContentType("text/plain");