fix: clean path in patch handler

2026-03-14 08:13:51 +01:00
parent c21af0791a
commit 4bd7d69c82
1 changed files with 2 additions and 0 deletions
--- a/http/resource.go
+++ b/http/resource.go
@@ -212,6 +212,8 @@ func resourcePatchHandler(fileCache FileCache) handleFunc {
 		dst := r.URL.Query().Get("destination")
 		action := r.URL.Query().Get("action")
 		dst, err := url.QueryUnescape(dst)
+		dst = path.Clean("/" + dst)
+		src = path.Clean("/" + src)
 		if !d.Check(src) || !d.Check(dst) {
 			return http.StatusForbidden, nil
 		}