some security patches and further python 2 compat

Thank you Lars Bensmann
This commit is contained in:
Daniel Gultsch 2015-07-09 08:52:42 +02:00
parent ac12bf5c54
commit c09664797d

View File

@ -19,6 +19,7 @@ except ImportError:
# Python 2 # Python 2
from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler
from SocketServer import ThreadingMixIn from SocketServer import ThreadingMixIn
FileNotFoundError = IOError
import sleekxmpp import sleekxmpp
from sleekxmpp.componentxmpp import ComponentXMPP from sleekxmpp.componentxmpp import ComponentXMPP
@ -116,7 +117,7 @@ class HttpHandler(BaseHTTPRequestHandler):
global config global config
path = normalize_path(self.path[1:]) path = normalize_path(self.path[1:])
slashcount = path.count('/') slashcount = path.count('/')
if slashcount < 1 or slashcount > 2: if path[0] in ('/', '\\') or slashcount < 1 or slashcount > 2:
self.send_response(404,'file not found') self.send_response(404,'file not found')
self.end_headers() self.end_headers()
else: else:
@ -139,7 +140,7 @@ class HttpHandler(BaseHTTPRequestHandler):
global config global config
path = normalize_path(self.path[1:]) path = normalize_path(self.path[1:])
slashcount = path.count('/') slashcount = path.count('/')
if slashcount < 1 or slashcount > 2: if path[0] in ('/', '\\') or slashcount < 1 or slashcount > 2:
self.send_response(404,'file not found') self.send_response(404,'file not found')
self.end_headers() self.end_headers()
else: else:
@ -173,7 +174,7 @@ if __name__ == "__main__":
server = ThreadedHTTPServer(('0.0.0.0', config['http_port']), HttpHandler) server = ThreadedHTTPServer(('0.0.0.0', config['http_port']), HttpHandler)
xmpp = MissingComponent(config['jid'],config['secret']) xmpp = MissingComponent(config['jid'],config['secret'])
if xmpp.connect(): if xmpp.connect():
xmpp.process(block=False) xmpp.process()
print("connected") print("connected")
server.serve_forever() server.serve_forever()
else: else: