Mirrors/blakeblackshear.frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2025-10-27 10:52:11 +01:00
Code Issues Projects Releases Wiki Activity

Ensure deleted export file name is safe (#8089)

Browse Source 
* Ensure deleted export file name is safe

* Fix import
This commit is contained in:
Nicolas Mowen 2023-10-07 08:12:48 -06:00 committed by GitHub
parent 14d2b79c72
commit 8941aa5311
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
frigate/http.py
View File

@ -29,6 +29,7 @@ from peewee import DoesNotExist, fn, operator
from playhouse.shortcuts import model_to_dict from playhouse.shortcuts import model_to_dict
from playhouse.sqliteq import SqliteQueueDatabase from playhouse.sqliteq import SqliteQueueDatabase
from tzlocal import get_localzone_name from tzlocal import get_localzone_name
from werkzeug.utils import secure_filename
from frigate.config import FrigateConfig from frigate.config import FrigateConfig
from frigate.const import ( from frigate.const import (
@ -1820,7 +1821,8 @@ def export_recording(camera_name: str, start_time, end_time):
@bp.route("/export/<file_name>", methods=["DELETE"]) @bp.route("/export/<file_name>", methods=["DELETE"])
def export_delete(file_name: str): def export_delete(file_name: str):
file = os.path.join(EXPORT_DIR, file_name) safe_file_name = secure_filename(file_name)
file = os.path.join(EXPORT_DIR, safe_file_name)
if not os.path.exists(file): if not os.path.exists(file):
return make_response( return make_response(