From b3e2e628ab6873ebb25a21f0981bc5cec5bcd392 Mon Sep 17 00:00:00 2001
From: Alexandre Teixeira <111787685+alteixeira20@users.noreply.github.com>
Date: Thu, 29 Oct 2026 01:25:07 +0000
Subject: [PATCH] fix(upload,ui): confine thumbnail paths and align stylesheet
cache-bust token
---
routes/upload_routes.py | 5 ++++-
static/index.html | 2 +-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/routes/upload_routes.py b/routes/upload_routes.py
index 081c01d5c..b139a5a82 100644
--- a/routes/upload_routes.py
+++ b/routes/upload_routes.py
@@ -461,7 +461,10 @@ def setup_upload_routes(upload_handler):
# Skip generation during HEAD probe to avoid loading/processing whole image.
if thumb and mime.startswith("image/"):
thumb_dir = os.path.join(_upload_root(), ".thumbs")
- thumb_path = os.path.join(thumb_dir, file_id + ".jpg")
+ safe_file_id = os.path.basename(file_id)
+ thumb_path = os.path.join(thumb_dir, safe_file_id + ".jpg")
+ if not _path_inside_upload_dir(thumb_path) or not is_inside(thumb_dir, thumb_path):
+ raise HTTPException(403, "Access denied")
if request.method == "HEAD":
if (os.path.isfile(thumb_path)
and os.path.getmtime(thumb_path) >= os.path.getmtime(path)):
diff --git a/static/index.html b/static/index.html
index 8cfe83c21..aafacc2e1 100644
--- a/static/index.html
+++ b/static/index.html
@@ -257,7 +257,7 @@
-
+