Merge pull request #239 from xuewenG/fix/check-image-path

删除图片时检查文件路径
kingwrcy · Dec 16, 2024 · fa4ad0a · fa4ad0a
2 parents 3d16997 + e95bf52
commit fa4ad0a
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/backend/handler/memo.go b/backend/handler/memo.go
@@ -63,7 +63,7 @@ func (m MemoHandler) RemoveImage(c echo.Context) error {
 		return FailResp(c, ParamError)
 	}
 
-	if !strings.HasPrefix(req.Img, "/upload/") {
+	if !strings.HasPrefix(req.Img, "/upload/") || strings.Contains(req.Img, "..") {
 		return SuccessResp(c, h{})
 	}