jpmschweitzer/odysseus
1
0
Fork 0
mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-10-29 17:22:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(upload,ui): confine thumbnail paths and align stylesheet cache-bust token

Browse Source
This commit is contained in:
Alexandre Teixeira
2026-10-29 01:25:07 +00:00
parent f843a3dc01
commit b3e2e628ab
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routes/upload_routes.py
+4 -1
View File
@@ -461,7 +461,10 @@ def setup_upload_routes(upload_handler):
# Skip generation during HEAD probe to avoid loading/processing whole image.
if thumb and mime.startswith("image/"):
thumb_dir = os.path.join(_upload_root(), ".thumbs")
thumb_path = os.path.join(thumb_dir, file_id + ".jpg")
safe_file_id = os.path.basename(file_id)
thumb_path = os.path.join(thumb_dir, safe_file_id + ".jpg")
if not _path_inside_upload_dir(thumb_path) or not is_inside(thumb_dir, thumb_path):
raise HTTPException(403, "Access denied")
if request.method == "HEAD":
if (os.path.isfile(thumb_path)
and os.path.getmtime(thumb_path) >= os.path.getmtime(path)):