修正漏洞,避免配置文件泄露

2020-03-30 18:54:39 +08:00 · 2020-03-30 18:54:39 +08:00 · 5a72550598
commit 5a72550598
parent db961deace
1 changed files with 2 additions and 1 deletions
--- a/WebMain.py
+++ b/WebMain.py
@ -168,7 +168,8 @@ def fileDownload(path):
            f.seek(offset)
            for row in f:
                yield row
-
+    if not (".mp4" in path or ".flv" in path):
+        return Response(status=404)
    if os.path.exists(path):
        if "RANGE" in request.headers:
            offset = int(request.headers["RANGE"].replace("=", "-").split("-")[1].strip())