From 651c8fdfa4e1aa2429b83871c1249ddfdc87ea5e Mon Sep 17 00:00:00 2001 From: Neale Pickett Date: Thu, 21 Feb 2019 22:08:21 -0700 Subject: [PATCH] Path traversal fix, beginning to work on teamid as auth --- src/instance.go | 19 +++++++++-- theme/index.html | 27 ++++++--------- theme/puzzle-list.html | 76 ------------------------------------------ 3 files changed, 27 insertions(+), 95 deletions(-) diff --git a/src/instance.go b/src/instance.go index 3a4021a..c226869 100644 --- a/src/instance.go +++ b/src/instance.go @@ -102,18 +102,31 @@ func (ctx *Instance) MaybeInitialize() { fmt.Fprintln(f, "Remove this file to reinitialize the contest") } +func pathCleanse(parts []string) string { + clean := make([]string, len(parts)) + for i := range parts { + part := parts[i] + part = strings.TrimLeft(part, ".") + if p := strings.LastIndex(part, "/"); p >= 0 { + part = part[p+1:] + } + clean[i] = part + } + return path.Join(clean...) +} + func (ctx Instance) MothballPath(parts ...string) string { - tail := path.Join(parts...) + tail := pathCleanse(parts) return path.Join(ctx.MothballDir, tail) } func (ctx *Instance) StatePath(parts ...string) string { - tail := path.Join(parts...) + tail := pathCleanse(parts) return path.Join(ctx.StateDir, tail) } func (ctx *Instance) ResourcePath(parts ...string) string { - tail := path.Join(parts...) + tail := pathCleanse(parts) return path.Join(ctx.ResourcesDir, tail) } diff --git a/theme/index.html b/theme/index.html index 51ad704..ad385c2 100644 --- a/theme/index.html +++ b/theme/index.html @@ -1,30 +1,25 @@ - Welcome - + Sign In + + -

Welcome

+

Sign In

-

Register your team

- -
- Team ID:
+
Team name: - - - -

- If someone on your team has already registered, - proceed to the - puzzles overview. -

+ Team ID:
+ +
+ +
+
diff --git a/theme/puzzle-list.html b/theme/puzzle-list.html index af42db5..3d1915b 100644 --- a/theme/puzzle-list.html +++ b/theme/puzzle-list.html @@ -7,82 +7,6 @@