From 793ef42704a0e0ce5bd044567032d697671bb3a8 Mon Sep 17 00:00:00 2001 From: Peter 'Pita' Martischka Date: Sat, 13 Aug 2011 20:20:30 +0100 Subject: [PATCH] added a error message for invalid padIDs --- node/server.js | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/node/server.js b/node/server.js index 3805e991..1b35233f 100644 --- a/node/server.js +++ b/node/server.js @@ -162,7 +162,7 @@ async.waterfall([ //ensure the padname is valid and the url doesn't end with a / if(!isValidPadname(req.params.pad) || /\/$/.test(req.url)) { - next(); + res.send('Such a padname is forbidden', 404); return; } @@ -177,7 +177,7 @@ async.waterfall([ //ensure the padname is valid and the url doesn't end with a / if(!isValidPadname(req.params.pad) || /\/$/.test(req.url)) { - next(); + res.send('Such a padname is forbidden', 404); return; } @@ -189,6 +189,13 @@ async.waterfall([ //serve timeslider.html under /p/$padname/timeslider app.get('/p/:pad/export/:type', function(req, res, next) { + //ensure the padname is valid and the url doesn't end with a / + if(!isValidPadname(req.params.pad) || /\/$/.test(req.url)) + { + res.send('Such a padname is forbidden', 404); + return; + } + var types = ["pdf", "doc", "txt", "html", "odt"]; //send a 404 if we don't support this filetype if(types.indexOf(req.params.type) == -1) @@ -212,6 +219,13 @@ async.waterfall([ //handle import requests app.post('/p/:pad/import', function(req, res, next) { + //ensure the padname is valid and the url doesn't end with a / + if(!isValidPadname(req.params.pad) || /\/$/.test(req.url)) + { + res.send('Such a padname is forbidden', 404); + return; + } + //if abiword is disabled, skip handling this request if(settings.abiword == null) {