Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP

Loading…

There is a line in paperboy.js that in Windows, always return 403 Forbidden #19

Merged
merged 7 commits into from

2 participants

@sidneylimafilho

No description provided.

@felixge felixge merged commit fd8267d into from
@felixge
Owner

Thx.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Commits on Aug 5, 2011
  1. BUG: This line make paperboy return 403 forbidden in node for windows

    sidneyfilho authored
    FIX: Check not only "/", as too "\"
  2. Merge branch 'master' of github.com:vivina/node-paperboy

    sidneyfilho authored
    Conflicts:
    	lib/paperboy.js
  3. BUG: This line make paperboy return 403 forbidden in node for windows

    sidneyfilho authored
    FIX: Check not only "/", as too "\"
  4. BUG: This line make paperboy return 403 forbidden in node for windows

    sidneyfilho authored
    FIX: Check not only "/", as too "\"
  5. Merge branch 'master' of github.com:vivina/node-paperboy

    sidneyfilho authored
    Conflicts:
    	lib/paperboy.js
  6. BUG: This line make paperboy return 403 forbidden in node for windows

    sidneyfilho authored
    FIX: Check not only "/", as too "\"
This page is out of date. Refresh to see the latest.
Showing with 2 additions and 1 deletion.
  1. +2 −1  lib/paperboy.js
View
3  lib/paperboy.js
@@ -4,13 +4,14 @@ var
url = require('url'),
path = require('path');
+
exports.filepath = function (webroot, url) {
// Unescape URL to prevent security holes
url = decodeURIComponent(url);
// Append index.html if path ends with '/'
fp = path.normalize(path.join(webroot, (url.match(/\/$/)=='/') ? url+'index.html' : url));
// Sanitize input, make sure people can't use .. to get above webroot
- if (webroot[webroot.length - 1] !== '/') webroot += '/';
+ if (!/\/|\\$/.test(webroot[webroot.length - 1])) { webroot = path.normalize(webroot + '/'); }
if (fp.substr(0, webroot.length) != webroot)
return(['Permission Denied', null]);
else
Something went wrong with that request. Please try again.