diff options
author | jaseg <git@jaseg.net> | 2019-06-25 14:22:13 +0900 |
---|---|---|
committer | jaseg <git@jaseg.net> | 2019-06-25 14:22:13 +0900 |
commit | fb2f3bcc2a6ec010e1ffc33b78833234f57da11a (patch) | |
tree | 7609c1a54ae9c263e4f4b1be747ef5e7c2d49017 /server.py | |
parent | 0ad5efec388db4f8e9233f4dfd5de716f680549e (diff) | |
download | secure-download-fb2f3bcc2a6ec010e1ffc33b78833234f57da11a.tar.gz secure-download-fb2f3bcc2a6ec010e1ffc33b78833234f57da11a.tar.bz2 secure-download-fb2f3bcc2a6ec010e1ffc33b78833234f57da11a.zip |
Verify download filenames in URL
Diffstat (limited to 'server.py')
-rw-r--r-- | server.py | 4 |
1 files changed, 2 insertions, 2 deletions
@@ -26,7 +26,7 @@ def download(file_id, token, filename): range_header = re.match('^bytes=([0-9]+)-([0-9]*)$', request.headers.get('Range', '')) if not range_header: try: - generator = filecrypt.decrypt_generator(path, token) + generator = filecrypt.decrypt_generator(path, filename, token) except ValueError: # MAC check failed abort(403) # forbidden @@ -40,7 +40,7 @@ def download(file_id, token, filename): abort(416) # range not satisfiable try: - generator = filecrypt.decrypt_generator(path, token, seek=range_start, end=range_end) + generator = filecrypt.decrypt_generator(path, filename, token, seek=range_start, end=range_end) except ValueError: # MAC check failed abort(403) # forbidden response = Response(generator, status=206, mimetype='application/octet-stream') |