From fb2f3bcc2a6ec010e1ffc33b78833234f57da11a Mon Sep 17 00:00:00 2001 From: jaseg Date: Tue, 25 Jun 2019 14:22:13 +0900 Subject: Verify download filenames in URL --- server.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'server.py') diff --git a/server.py b/server.py index b084298..694b1ac 100644 --- a/server.py +++ b/server.py @@ -26,7 +26,7 @@ def download(file_id, token, filename): range_header = re.match('^bytes=([0-9]+)-([0-9]*)$', request.headers.get('Range', '')) if not range_header: try: - generator = filecrypt.decrypt_generator(path, token) + generator = filecrypt.decrypt_generator(path, filename, token) except ValueError: # MAC check failed abort(403) # forbidden @@ -40,7 +40,7 @@ def download(file_id, token, filename): abort(416) # range not satisfiable try: - generator = filecrypt.decrypt_generator(path, token, seek=range_start, end=range_end) + generator = filecrypt.decrypt_generator(path, filename, token, seek=range_start, end=range_end) except ValueError: # MAC check failed abort(403) # forbidden response = Response(generator, status=206, mimetype='application/octet-stream') -- cgit