Call secure_filename on the filename first thing, so we don't end up working with multiple versions of the same filename

This commit is contained in:
Micah Lee 2019-02-11 23:05:51 -08:00
parent 9115ff89f3
commit 5901866200
No known key found for this signature in database
GPG Key ID: 403C2657CD994F73

View File

@ -158,10 +158,11 @@ class ReceiveModeFile(object):
self.onionshare_write_func = write_func
self.onionshare_close_func = close_func
self.filename = os.path.join(self.onionshare_request.receive_mode_dir, secure_filename(filename))
self.filename = os.path.join(self.onionshare_request.receive_mode_dir, filename)
self.filename_in_progress = '{}.part'.format(self.filename)
# Open the file
self.upload_error = False
try:
self.f = open(self.filename_in_progress, 'wb+')
except:
@ -316,6 +317,8 @@ class ReceiveModeRequest(Request):
self.told_gui_about_request = True
filename = secure_filename(filename)
self.progress[filename] = {
'uploaded_bytes': 0,
'complete': False