libretic/etherpad-lite
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

added a error message for invalid padIDs

Browse source
This commit is contained in:
Peter 'Pita' Martischka 2011-08-13 20:20:30 +01:00
parent 0229217baf
commit 793ef42704
1 changed files with 16 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
node/server.js
View file

@ -162,7 +162,7 @@ async.waterfall([
//ensure the padname is valid and the url doesn't end with a / //ensure the padname is valid and the url doesn't end with a /
if(!isValidPadname(req.params.pad) || /\/$/.test(req.url)) if(!isValidPadname(req.params.pad) || /\/$/.test(req.url))
{ {
next(); res.send('Such a padname is forbidden', 404);
return; return;
} }
@ -177,7 +177,7 @@ async.waterfall([
//ensure the padname is valid and the url doesn't end with a / //ensure the padname is valid and the url doesn't end with a /
if(!isValidPadname(req.params.pad) || /\/$/.test(req.url)) if(!isValidPadname(req.params.pad) || /\/$/.test(req.url))
{ {
next(); res.send('Such a padname is forbidden', 404);
return; return;
} }
@ -189,6 +189,13 @@ async.waterfall([
//serve timeslider.html under /p/$padname/timeslider //serve timeslider.html under /p/$padname/timeslider
app.get('/p/:pad/export/:type', function(req, res, next) app.get('/p/:pad/export/:type', function(req, res, next)
{ {
//ensure the padname is valid and the url doesn't end with a /
if(!isValidPadname(req.params.pad) || /\/$/.test(req.url))
{
res.send('Such a padname is forbidden', 404);
return;
}
var types = ["pdf", "doc", "txt", "html", "odt"]; var types = ["pdf", "doc", "txt", "html", "odt"];
//send a 404 if we don't support this filetype //send a 404 if we don't support this filetype
if(types.indexOf(req.params.type) == -1) if(types.indexOf(req.params.type) == -1)
@ -212,6 +219,13 @@ async.waterfall([
//handle import requests //handle import requests
app.post('/p/:pad/import', function(req, res, next) app.post('/p/:pad/import', function(req, res, next)
{ {
//ensure the padname is valid and the url doesn't end with a /
if(!isValidPadname(req.params.pad) || /\/$/.test(req.url))
{
res.send('Such a padname is forbidden', 404);
return;
}
//if abiword is disabled, skip handling this request //if abiword is disabled, skip handling this request
if(settings.abiword == null) if(settings.abiword == null)
{ {