[svn r808] fixed some security bugs trunk
authorrenatofilho
Mon Aug 13 23:03:08 2007 +0100 (2007-08-13)
branchtrunk
changeset 802d0e8c542c38e
parent 801 e51af4d0caf5
child 803 b1d0964060b3
[svn r808] fixed some security bugs
gmyth-stream/server/0.3/lib/request_handler.py
     1.1 --- a/gmyth-stream/server/0.3/lib/request_handler.py	Mon Aug 13 22:54:55 2007 +0100
     1.2 +++ b/gmyth-stream/server/0.3/lib/request_handler.py	Mon Aug 13 23:03:08 2007 +0100
     1.3 @@ -355,8 +355,14 @@
     1.4      # serve_file_info()
     1.5  
     1.6      def serve_stream(self, body):
     1.7 -        filename = self.query.get("uri", None)[0]
     1.8 +        filename = self.query.get("file", None)[0]
     1.9  
    1.10 +        if not filename:
    1.11 +            self.send_error(404, "File not found")
    1.12 +            return
    1.13 +
    1.14 +        #Only stream files on .transcode dir
    1.15 +        filename = ".transcode/" + os.path.basename(filename)
    1.16          if not os.path.exists (filename):
    1.17              self.send_error(404, "File not found")
    1.18              return
    1.19 @@ -387,7 +393,8 @@
    1.20                  status = utils.progress_bar(total_read, size, 50)
    1.21                  msg_status = "Status:%s:%s%%" % (test_tid, status)
    1.22                  self.transcoders_log._update_status(test_tid, msg_status)
    1.23 -                self.transcoders_log._update_status(test_tid, "OK: Done")
    1.24 +
    1.25 +            self.transcoders_log._update_status(test_tid, "OK: Done")
    1.26  
    1.27          except Exception, e:
    1.28              self.log.error("Stream error: %s" %e)
    1.29 @@ -395,6 +402,11 @@
    1.30      # serve_stream()
    1.31  
    1.32      def serve_transcode(self, body):
    1.33 +        type = self.query.get("type", None)[0]
    1.34 +        if type.upper() == "FILE":
    1.35 +            self.send_error(404, "Transcode local files not allowed")
    1.36 +            return
    1.37 +
    1.38          transcoder = self._get_transcoder()
    1.39          try:
    1.40              obj = transcoder(self.query)
    1.41 @@ -409,7 +421,7 @@
    1.42          if (obj.name == "gmencoder"):
    1.43              self.send_header("Transfer-Encoding", "chunked")
    1.44  
    1.45 -        self.send_header("Connection", "close")
    1.46 +        #self.send_header("Connection", "close")
    1.47          self.end_headers()
    1.48  
    1.49          if body: