git.ipfire.org Git - thirdparty/tornado.git/commit

]> git.ipfire.org Git - thirdparty/tornado.git/commit

projects / thirdparty / tornado.git / commit

author	Ben Darnell <ben@bendarnell.com>
	Fri, 17 Jul 2015 15:36:53 +0000 (11:36 -0400)
committer	Ben Darnell <ben@bendarnell.com>
	Fri, 17 Jul 2015 15:36:53 +0000 (11:36 -0400)
commit	ecb3ea7543cc942659faf3d2144853018afa6139
tree	e6c9fea818e7da6c42b39b3e6cc28b4f5cfd562f	tree
parent	fdfaf3dffa49479c7461050eacca07bc5ee8d207	commit \| diff

Fix path traversal check in StaticFileHandler.

Previously StaticFileHandler would allow access to files whose name
starts with the static root directory, not just those that are actually
in the directory.

The bug was introduced in Tornado 3.1 via commits 7b03cd62fb and
60952528.

MANIFEST.in		diff \| blob \| blame \| history
setup.py		diff \| blob \| blame \| history
tornado/test/static_foo.txt	[new file with mode: 0644]	blob
tornado/test/web_test.py		diff \| blob \| blame \| history
tornado/web.py		diff \| blob \| blame \| history

Mirror of https://github.com/tornadoweb/tornado.git

RSS Atom