mirror/MCSManager
2
0
Fork 1
mirror of https://github.com/MCSManager/MCSManager.git synced 2025-02-17 15:59:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

审计 文件在线管理部分

Browse Source
This commit is contained in:
Suwings 2020-03-02 22:19:34 +08:00
parent 6e4ee86aa5
commit 47e495943b
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
onlinefs/controller/function.js
View File

@ -31,6 +31,7 @@ router.post('/mkdir', (req, res) => {
router.post('/ls', (req, res) => { router.post('/ls', (req, res) => {
let name = parseHandle(req.body, "string") || "./"; let name = parseHandle(req.body, "string") || "./";
// 唯一的当前目录赋值场景
req.session.fsos.cwd = pathm.normalize(pathm.join(req.session.fsos.cwd, name)); req.session.fsos.cwd = pathm.normalize(pathm.join(req.session.fsos.cwd, name));
let fileOperate = new UseFileOperate(req.session.fsos).fileOperate; let fileOperate = new UseFileOperate(req.session.fsos).fileOperate;
if (req.session.fsos.cwd == "..\\" || req.session.fsos.cwd == "../") req.session.fsos.cwd = "./"; //越级,重置 if (req.session.fsos.cwd == "..\\" || req.session.fsos.cwd == "../") req.session.fsos.cwd = "./"; //越级,重置
@ -106,8 +107,7 @@ router.post('/rename', (req, res) => {
router.post('/edit_read', (req, res) => { router.post('/edit_read', (req, res) => {
const filename = (parseHandle(req.body)) const filename = (parseHandle(req.body))
if (!filename) return; if (!filename) return;
//没有经过安全的 UseFileOperate 进行安全操作 //先进行基本的越权过滤
//必须经过目录越级漏洞防御
if (filename.indexOf('../') != -1 || filename.indexOf('./') != -1) return; if (filename.indexOf('../') != -1 || filename.indexOf('./') != -1) return;
const cwd = req.session.fsos.cwd; const cwd = req.session.fsos.cwd;
const fileOperate = new UseFileOperate(req.session.fsos).fileOperate; const fileOperate = new UseFileOperate(req.session.fsos).fileOperate;
@ -119,8 +119,7 @@ router.post('/edit_read', (req, res) => {
router.post('/edit_write', (req, res) => { router.post('/edit_write', (req, res) => {
const obj = (parseHandle(req.body)) const obj = (parseHandle(req.body))
if (!obj || !obj.filename || !obj.context) return; if (!obj || !obj.filename || !obj.context) return;
//没有经过安全的 UseFileOperate 进行安全操作 //先进行基本的越权过滤
//必须经过目录越级漏洞防御
if (obj.filename.indexOf('../') != -1 || obj.filename.indexOf('./') != -1) return; if (obj.filename.indexOf('../') != -1 || obj.filename.indexOf('./') != -1) return;
const cwd = req.session.fsos.cwd; const cwd = req.session.fsos.cwd;
const fileOperate = new UseFileOperate(req.session.fsos).fileOperate; const fileOperate = new UseFileOperate(req.session.fsos).fileOperate;
@ -176,6 +175,8 @@ router.post('/upload', (req, res) => {
try { try {
fileOperate = new UseFileOperate(req.session.fsos).fileOperate; fileOperate = new UseFileOperate(req.session.fsos).fileOperate;
target_path = fileOperate.normalizePath(req.session.fsos.cwd); //获取绝对路径 target_path = fileOperate.normalizePath(req.session.fsos.cwd); //获取绝对路径
if (!fileOperate.isPathAccess(target_path)) return;
//生成multiparty对象，并配置上传目标路径 //生成multiparty对象，并配置上传目标路径
var form = new multiparty.Form({ var form = new multiparty.Form({
uploadDir: os.tmpdir() uploadDir: os.tmpdir()