From e9107142371a24bf6356f7aa25f38721755b368d Mon Sep 17 00:00:00 2001 From: davrot Date: Mon, 27 Jan 2025 20:36:28 +0000 Subject: [PATCH 1/4] =?UTF-8?q?Dateien=20nach=20=E2=80=9Eservices/reposito?= =?UTF-8?q?ry/files=E2=80=9C=20hochladen?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- services/repository/files/upload.go | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/services/repository/files/upload.go b/services/repository/files/upload.go index 1d71058800..769b26d167 100644 --- a/services/repository/files/upload.go +++ b/services/repository/files/upload.go @@ -6,11 +6,11 @@ package files import ( "context" "fmt" + "html" "os" "path" + "regexp" "strings" - "regexp" - "html" git_model "code.gitea.io/gitea/models/git" repo_model "code.gitea.io/gitea/models/repo" @@ -168,12 +168,12 @@ var fileNameSanitizeRegexp = regexp.MustCompile(`(?i)\.\.|[<>:\"\\|?*\x{0000}-\x // Sanitize user input to valid OS filenames // -// Based on https://github.com/sindresorhus/filename-reserved-regex -// Adds ".." to prevent directory traversal +// Based on https://github.com/sindresorhus/filename-reserved-regex +// Adds ".." to prevent directory traversal func fileNameSanitize(s string) string { // Added this because I am not sure what Windows will deliver us \ or / but we need /. s = strings.ReplaceAll(s, "\\", "/") - return strings.TrimSpace(fileNameSanitizeRegexp.ReplaceAllString(s, "_")) + return strings.TrimSpace(fileNameSanitizeRegexp.ReplaceAllString(s, "_")) } func copyUploadedLFSFilesIntoRepository(infos []uploadInfo, t *TemporaryUploadRepository, treePath string) error { From 4a20a897e49ac4e0e418d50ebb997ba5bebb6f71 Mon Sep 17 00:00:00 2001 From: davrot Date: Mon, 27 Jan 2025 20:36:52 +0000 Subject: [PATCH 2/4] =?UTF-8?q?Dateien=20nach=20=E2=80=9Eservices/forms?= =?UTF-8?q?=E2=80=9C=20hochladen?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From 17b690673dd4f522d91e4a2d16e4fd5924d723a5 Mon Sep 17 00:00:00 2001 From: davrot Date: Mon, 27 Jan 2025 20:37:18 +0000 Subject: [PATCH 3/4] =?UTF-8?q?Dateien=20nach=20=E2=80=9Erouters/web?= =?UTF-8?q?=E2=80=9C=20hochladen?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- routers/web/web.go | 31 +++++++++++++++---------------- 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/routers/web/web.go b/routers/web/web.go index 81fa289e2e..93ca5ba828 100644 --- a/routers/web/web.go +++ b/routers/web/web.go @@ -51,12 +51,12 @@ import ( _ "code.gitea.io/gitea/modules/session" // to registers all internal adapters + "code.forgejo.org/go-chi/binding" "code.forgejo.org/go-chi/captcha" chi_middleware "github.com/go-chi/chi/v5/middleware" "github.com/go-chi/cors" "github.com/klauspost/compress/gzhttp" "github.com/prometheus/client_golang/prometheus" - "code.forgejo.org/go-chi/binding" ) var GzipMinSize = gzhttp.DefaultMinSize @@ -1674,19 +1674,18 @@ func registerRoutes(m *web.Route) { } func BindUpload(f forms.UploadRepoFileForm) http.HandlerFunc { - return func(resp http.ResponseWriter, req *http.Request) { - - theObj := new(forms.UploadRepoFileForm) // create a new form obj for every request but not use obj directly - data := middleware.GetContextData(req.Context()) - binding.Bind(req, theObj) - files := theObj.Files - var fullpaths []string - for _, fileID := range files { - fullPath := req.Form.Get("files_fullpath[" + fileID + "]") - fullpaths = append(fullpaths, fullPath) - } - theObj.FullPaths = fullpaths - data.GetData()["__form"] = theObj - middleware.AssignForm(theObj, data) - } + return func(resp http.ResponseWriter, req *http.Request) { + theObj := new(forms.UploadRepoFileForm) // create a new form obj for every request but not use obj directly + data := middleware.GetContextData(req.Context()) + binding.Bind(req, theObj) + files := theObj.Files + var fullpaths []string + for _, fileID := range files { + fullPath := req.Form.Get("files_fullpath[" + fileID + "]") + fullpaths = append(fullpaths, fullPath) + } + theObj.FullPaths = fullpaths + data.GetData()["__form"] = theObj + middleware.AssignForm(theObj, data) + } } From 5eb09842e83a73f4075340331741c3e36ffca67a Mon Sep 17 00:00:00 2001 From: davrot Date: Mon, 27 Jan 2025 20:37:31 +0000 Subject: [PATCH 4/4] =?UTF-8?q?Dateien=20nach=20=E2=80=9Erouters/web/repo?= =?UTF-8?q?=E2=80=9C=20hochladen?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit