me0nline/LOGAR
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

fix(config): safe config file path resolution and isolation
CI Test Suite / Run Component Tests & Pipeline Verification (push) Successful in 1m34s
Details

Browse Source
This commit is contained in:
me0nline
2026-09-30 17:39:48 +02:00
parent 22072a0b88
commit f0bf90e033
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Server.py
+7 -5
View File
@@ -832,6 +832,7 @@ def load_or_init_config(config_path: str = CONFIG_FILE_NAME) -> Dict[str, Any]:
# Resolve relative db_path and cert_dir to writable paths # Resolve relative db_path and cert_dir to writable paths
config["db_path"] = resolve_writable_path(config["db_path"], "LOGAR-Server", DEFAULT_DB_FILE) config["db_path"] = resolve_writable_path(config["db_path"], "LOGAR-Server", DEFAULT_DB_FILE)
config["cert_dir"] = resolve_writable_path(config["cert_dir"], "LOGAR-Server", "certs") config["cert_dir"] = resolve_writable_path(config["cert_dir"], "LOGAR-Server", "certs")
config["config_file_path"] = os.path.abspath(actual_config_path)
global SESSION_SECRET, _CACHED_SESSION_SECRET global SESSION_SECRET, _CACHED_SESSION_SECRET
if not os.environ.get("LOGAR_SESSION_SECRET") and "session_secret" in config: if not os.environ.get("LOGAR_SESSION_SECRET") and "session_secret" in config:
@@ -873,7 +874,8 @@ def load_or_init_config(config_path: str = CONFIG_FILE_NAME) -> Dict[str, Any]:
"min_persistence_runs": RUN_THRESHOLD, "min_persistence_runs": RUN_THRESHOLD,
"server_fingerprint": fingerprint, "server_fingerprint": fingerprint,
"public_key": public_key, "public_key": public_key,
"private_key": private_key "private_key": private_key,
"config_file_path": os.path.abspath(config_path)
} }
if not os.environ.get("LOGAR_SESSION_SECRET"): if not os.environ.get("LOGAR_SESSION_SECRET"):
SESSION_SECRET = session_sec SESSION_SECRET = session_sec
@@ -3115,8 +3117,8 @@ def api_db_switch_backend(req: DbSwitchBackendRequest):
if req.db_path: if req.db_path:
config["db_path"] = req.db_path config["db_path"] = req.db_path
cfg_path = config.get("config_file_path", CONFIG_FILE_NAME) cfg_path = config.get("config_file_path")
if os.path.exists(cfg_path): if cfg_path and os.path.exists(cfg_path):
try: try:
with open(cfg_path, "w", encoding="utf-8") as f: with open(cfg_path, "w", encoding="utf-8") as f:
json.dump(config, f, indent=2) json.dump(config, f, indent=2)
@@ -3177,8 +3179,8 @@ def api_db_update_config(req: DbFullConfigRequest):
if not ok: if not ok:
raise HTTPException(status_code=400, detail=f"PostgreSQL connection/init failed: {msg}") raise HTTPException(status_code=400, detail=f"PostgreSQL connection/init failed: {msg}")
cfg_path = config.get("config_file_path", CONFIG_FILE_NAME) cfg_path = config.get("config_file_path")
if os.path.exists(cfg_path): if cfg_path and os.path.exists(cfg_path):
try: try:
with open(cfg_path, "w", encoding="utf-8") as f: with open(cfg_path, "w", encoding="utf-8") as f:
json.dump(config, f, indent=2) json.dump(config, f, indent=2)