path check

usmannasir · Jan 17, 2020 · b88922e · b88922e
1 parent 050c020
commit b88922e
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/filemanager/filemanager.py b/filemanager/filemanager.py
@@ -272,6 +272,11 @@ def readFileContents(self):
             domainName = self.data['domainName']
             website = Websites.objects.get(domain=domainName)
 
+            pathCheck = '/home/%s' % (domainName)
+
+            if self.data['fileName'].find(pathCheck) == -1:
+                return self.ajaxPre(0, 'Not allowed.')
+
             command = 'cat ' + self.returnPathEnclosed(self.data['fileName'])
             finalData['fileContents'] = ProcessUtilities.outputExecutioner(command, website.externalApp)