liz/wikijs-fork
liz/wikijs-fork
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: strip starting slash from path during page create

Browse Source
This commit is contained in:
NGPixel 2020-06-05 14:52:36 -04:00
parent deacd80c45
commit 65f71d8e3b
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
server/models/pages.js
View File

@ -214,7 +214,7 @@ module.exports = class Page extends Model {
*/ */
static async createPage(opts) { static async createPage(opts) {
// -> Validate path // -> Validate path
if (opts.path.indexOf('.') >= 0 || opts.path.indexOf(' ') >= 0 || opts.path.indexOf('\\') >= 0) { if (opts.path.indexOf('.') >= 0 || opts.path.indexOf(' ') >= 0 || opts.path.indexOf('\\') >= 0 || opts.path.indexOf('//') >= 0) {
throw new WIKI.Error.PageIllegalPath() throw new WIKI.Error.PageIllegalPath()
} }
@ -223,6 +223,11 @@ module.exports = class Page extends Model {
opts.path = opts.path.slice(0, -1) opts.path = opts.path.slice(0, -1)
} }
// -> Remove starting slash
if (opts.path.startsWith('/')) {
opts.path = opts.path.slice(1)
}
// -> Check for page access // -> Check for page access
if (!WIKI.auth.checkAccess(opts.user, ['write:pages'], { if (!WIKI.auth.checkAccess(opts.user, ['write:pages'], {
locale: opts.locale, locale: opts.locale,
@ -404,7 +409,7 @@ module.exports = class Page extends Model {
} }
// -> Validate path // -> Validate path
if (opts.destinationPath.indexOf('.') >= 0 || opts.destinationPath.indexOf(' ') >= 0 || opts.destinationPath.indexOf('\\') >= 0) { if (opts.destinationPath.indexOf('.') >= 0 || opts.destinationPath.indexOf(' ') >= 0 || opts.destinationPath.indexOf('\\') >= 0 || opts.destinationPath.indexOf('//') >= 0) {
throw new WIKI.Error.PageIllegalPath() throw new WIKI.Error.PageIllegalPath()
} }
@ -413,6 +418,11 @@ module.exports = class Page extends Model {
opts.destinationPath = opts.destinationPath.slice(0, -1) opts.destinationPath = opts.destinationPath.slice(0, -1)
} }
// -> Remove starting slash
if (opts.destinationPath.startsWith('/')) {
opts.destinationPath = opts.destinationPath.slice(1)
}
// -> Check for source page access // -> Check for source page access
if (!WIKI.auth.checkAccess(opts.user, ['manage:pages'], { if (!WIKI.auth.checkAccess(opts.user, ['manage:pages'], {
locale: page.localeCode, locale: page.localeCode,