From fe9d43cab6c66f89ef999ad8868de900168c6fe8 Mon Sep 17 00:00:00 2001 From: max Date: Fri, 2 Oct 2026 22:31:17 +0200 Subject: [PATCH] Harden endpoint authorization, filename sanitization, and updater imports --- src/Server.py | 15 +++++++++------ src/client_updater.py | 1 + src/update_manager.py | 3 ++- 3 files changed, 12 insertions(+), 7 deletions(-) diff --git a/src/Server.py b/src/Server.py index 18f3acf..797be83 100644 --- a/src/Server.py +++ b/src/Server.py @@ -1526,7 +1526,7 @@ def download_client_update_package(os: Optional[str] = "windows", os_name: Optio @app.post("/api/server/client-package/upload") async def upload_client_package( request: Request, - user: str = Depends(get_current_user_optional) + auth_user: str = Depends(require_admin_auth) ): """ Uploads a new client executable/installer into the server's update distribution repository. @@ -1534,6 +1534,7 @@ async def upload_client_package( or raw stream with headers 'X-Package-OS', 'X-Package-Filename', 'X-Package-Version'. """ import base64 + import os as _os mgr: ServerUpdateManager = SERVER_STATE.get("update_manager") or UPDATE_MANAGER content_type = request.headers.get("content-type", "") @@ -1546,21 +1547,23 @@ async def upload_client_package( body = await request.json() os_type = body.get("os", "windows") version = body.get("version") - filename = body.get("filename") or ("LOGAR_Client_Setup.exe" if os_type == "windows" else "Linux_Client.bin") + raw_name = body.get("filename") or ("LOGAR_Client_Setup.exe" if os_type == "windows" else "Linux_Client.bin") + filename = _os.path.basename(str(raw_name)) b64_data = body.get("data_base64", "") file_bytes = base64.b64decode(b64_data) else: os_type = request.headers.get("X-Package-OS", "windows") version = request.headers.get("X-Package-Version") - filename = request.headers.get("X-Package-Filename") or ("LOGAR_Client_Setup.exe" if os_type == "windows" else "Linux_Client.bin") + raw_name = request.headers.get("X-Package-Filename") or ("LOGAR_Client_Setup.exe" if os_type == "windows" else "Linux_Client.bin") + filename = _os.path.basename(str(raw_name)) file_bytes = await request.body() if not file_bytes: raise HTTPException(status_code=400, detail="Empty package payload.") - temp_dir = os.path.join(mgr.update_dir, "temp") - os.makedirs(temp_dir, exist_ok=True) - temp_path = os.path.join(temp_dir, filename) + temp_dir = _os.path.join(mgr.update_dir, "temp") + _os.makedirs(temp_dir, exist_ok=True) + temp_path = _os.path.join(temp_dir, filename) with open(temp_path, "wb") as f: f.write(file_bytes) diff --git a/src/client_updater.py b/src/client_updater.py index 2cbed4f..9ad6a08 100644 --- a/src/client_updater.py +++ b/src/client_updater.py @@ -14,6 +14,7 @@ import tempfile import subprocess import urllib.request import urllib.error +import urllib.parse from typing import Dict, Any, Optional, Tuple try: diff --git a/src/update_manager.py b/src/update_manager.py index febc114..ce5ec58 100644 --- a/src/update_manager.py +++ b/src/update_manager.py @@ -89,7 +89,8 @@ class ServerUpdateManager: target_dir = os.path.join(self.update_dir, norm_os) os.makedirs(target_dir, exist_ok=True) - target_name = filename or os.path.basename(file_path) + raw_name = filename or os.path.basename(file_path) + target_name = os.path.basename(raw_name) dest_path = os.path.join(target_dir, target_name) if os.path.abspath(file_path) != os.path.abspath(dest_path):