防止用"../../来获取其它文件"

2016-10-27 15:09:10 +08:00
parent 15d8ebdc0f
commit 6a06511405
1 changed files with 5 additions and 0 deletions
--- a/app/service/ThemeService.go
+++ b/app/service/ThemeService.go
@ -266,6 +266,11 @@ func (this *ThemeService) GetDefaultThemes() (themes []info.Theme) {

 // 得到模板内容
 func (this *ThemeService) GetTplContent(userId, themeId, filename string) string {
+	// 防止用"../../来获取其它文件"
+	if (strings.Contains(filename, "../")) {
+		return ""
+	}
+	
 	path := this.GetThemeAbsolutePath(userId, themeId) + "/" + filename
 	return GetFileStrContent(path)
 }