Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2026-02-08 08:14:21 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

🔒 Fix https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c4jr-5q7w-f6r9

Browse source 
Signed-off-by: Daniel <845765@qq.com>
This commit is contained in:
Daniel 2026-01-28 21:42:30 +08:00
parent 399a38893e
commit d7f790755e
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
2 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
kernel/api/file.go
View file

@ -141,6 +141,14 @@ func copyFile(c *gin.Context) {
}
dest := arg["dest"].(string)
if util.IsSensitivePath(dest) {
msg := fmt.Sprintf("refuse to copy sensitive file [%s]", dest)
logging.LogErrorf(msg)
ret.Code = -2
ret.Msg = msg
return
}
if err = filelock.Copy(src, dest); err != nil {
logging.LogErrorf("copy file [%s] to [%s] failed: %s", src, dest, err)
ret.Code = -1