From 01bcbc54e9e2970771027a68fda62624a743e26e Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: Sep 05 2016 09:23:57 +0000 Subject: Fix checking if the target folder exists on uploading releases to forks ``werkzeug.secure_filename()`` would convert /forks/user/project into forks_user_project making the check for the target folder invalid. Thus we're removing it. The regex used when creating the project should cover our back on insuring the project name is safe/secure. Fixes https://pagure.io/pagure/issue/1262 --- diff --git a/pagure/ui/repo.py b/pagure/ui/repo.py index 7eb9721..d287b21 100644 --- a/pagure/ui/repo.py +++ b/pagure/ui/repo.py @@ -932,7 +932,7 @@ def new_release(repo, username=None): try: folder = os.path.join( APP.config['UPLOAD_FOLDER_PATH'], - werkzeug.secure_filename(repo.fullname)) + repo.fullname) if not os.path.exists(folder): os.mkdir(folder) filestream.save(os.path.join(folder, filename))