2
0
Эх сурвалжийг харах

fix: strip starting slash from path during page create

NGPixel 5 жил өмнө
parent
commit
65f71d8e3b
1 өөрчлөгдсөн 12 нэмэгдсэн , 2 устгасан
  1. 12 2
      server/models/pages.js

+ 12 - 2
server/models/pages.js

@@ -214,7 +214,7 @@ module.exports = class Page extends Model {
    */
   static async createPage(opts) {
     // -> Validate path
-    if (opts.path.indexOf('.') >= 0 || opts.path.indexOf(' ') >= 0 || opts.path.indexOf('\\') >= 0) {
+    if (opts.path.indexOf('.') >= 0 || opts.path.indexOf(' ') >= 0 || opts.path.indexOf('\\') >= 0 || opts.path.indexOf('//') >= 0) {
       throw new WIKI.Error.PageIllegalPath()
     }
 
@@ -223,6 +223,11 @@ module.exports = class Page extends Model {
       opts.path = opts.path.slice(0, -1)
     }
 
+    // -> Remove starting slash
+    if (opts.path.startsWith('/')) {
+      opts.path = opts.path.slice(1)
+    }
+
     // -> Check for page access
     if (!WIKI.auth.checkAccess(opts.user, ['write:pages'], {
       locale: opts.locale,
@@ -404,7 +409,7 @@ module.exports = class Page extends Model {
     }
 
     // -> Validate path
-    if (opts.destinationPath.indexOf('.') >= 0 || opts.destinationPath.indexOf(' ') >= 0 || opts.destinationPath.indexOf('\\') >= 0) {
+    if (opts.destinationPath.indexOf('.') >= 0 || opts.destinationPath.indexOf(' ') >= 0 || opts.destinationPath.indexOf('\\') >= 0 || opts.destinationPath.indexOf('//') >= 0) {
       throw new WIKI.Error.PageIllegalPath()
     }
 
@@ -413,6 +418,11 @@ module.exports = class Page extends Model {
       opts.destinationPath = opts.destinationPath.slice(0, -1)
     }
 
+    // -> Remove starting slash
+    if (opts.destinationPath.startsWith('/')) {
+      opts.destinationPath = opts.destinationPath.slice(1)
+    }
+
     // -> Check for source page access
     if (!WIKI.auth.checkAccess(opts.user, ['manage:pages'], {
       locale: page.localeCode,