Nemcio/CyberPanel
1
0
Fork 0
mirror of https://github.com/usmannasir/cyberpanel.git synced 2025-11-08 14:26:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

bug fix file manager: file deletion

Browse Source
This commit is contained in:
usmannasir
2024-11-04 13:12:08 +05:00
parent 2041deae13
commit 857f4a966d
1 changed files with 27 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
CyberCP/secMiddleware.py
View File

@@ -94,6 +94,7 @@ class secMiddleware:
except: except:
pass pass
if bool(request.body): if bool(request.body):
try: try:
@@ -108,11 +109,21 @@ class secMiddleware:
data = request.POST data = request.POST
for key, value in data.items(): for key, value in data.items():
valueAlreadyChecked = 0
if os.path.exists(ProcessUtilities.debugPath):
logging.writeToFile(f'Key being scanned {str(key)}')
logging.writeToFile(f'Value being scanned {str(value)}')
if request.path.find('gitNotify') > -1: if request.path.find('gitNotify') > -1:
break break
if type(value) == str or type(value) == bytes: if type(value) == str or type(value) == bytes:
pass pass
elif type(value) == list: elif type(value) == list:
valueAlreadyChecked = 1
if os.path.exists(ProcessUtilities.debugPath):
logging.writeToFile(f'Item type detected as list')
for items in value: for items in value:
if items.find('- -') > -1 or items.find('\n') > -1 or items.find(';') > -1 or items.find( if items.find('- -') > -1 or items.find('\n') > -1 or items.find(';') > -1 or items.find(
'&&') > -1 or items.find('|') > -1 or items.find('...') > -1 \ '&&') > -1 or items.find('|') > -1 or items.find('...') > -1 \
@@ -157,20 +168,22 @@ class secMiddleware:
or key == 'modSecRules' or key == 'recordContentTXT' or key == 'SecAuditLogRelevantStatus' \ or key == 'modSecRules' or key == 'recordContentTXT' or key == 'SecAuditLogRelevantStatus' \
or key == 'fileContent' or key == 'commands' or key == 'gitHost' or key == 'ipv6' or key == 'contentNow': or key == 'fileContent' or key == 'commands' or key == 'gitHost' or key == 'ipv6' or key == 'contentNow':
continue continue
if value.find('- -') > -1 or value.find('\n') > -1 or value.find(';') > -1 or value.find(
'&&') > -1 or value.find('|') > -1 or value.find('...') > -1 \ if valueAlreadyChecked == 0:
or value.find("`") > -1 or value.find("$") > -1 or value.find("(") > -1 or value.find( if value.find('- -') > -1 or value.find('\n') > -1 or value.find(';') > -1 or value.find(
")") > -1 \ '&&') > -1 or value.find('|') > -1 or value.find('...') > -1 \
or value.find("'") > -1 or value.find("[") > -1 or value.find("]") > -1 or value.find( or value.find("`") > -1 or value.find("$") > -1 or value.find("(") > -1 or value.find(
"{") > -1 or value.find("}") > -1 \ ")") > -1 \
or value.find(":") > -1 or value.find("<") > -1 or value.find(">") > -1 or value.find( or value.find("'") > -1 or value.find("[") > -1 or value.find("]") > -1 or value.find(
"&") > -1: "{") > -1 or value.find("}") > -1 \
logging.writeToFile(request.body) or value.find(":") > -1 or value.find("<") > -1 or value.find(">") > -1 or value.find(
final_dic = { "&") > -1:
'error_message': "Data supplied is not accepted, following characters are not allowed in the input ` $ & ( ) [ ] { } ; : ‘ < >.", logging.writeToFile(request.body)
"errorMessage": "Data supplied is not accepted, following characters are not allowed in the input ` $ & ( ) [ ] { } ; : ‘ < >."} final_dic = {
final_json = json.dumps(final_dic) 'error_message': "Data supplied is not accepted, following characters are not allowed in the input ` $ & ( ) [ ] { } ; : ‘ < >.",
return HttpResponse(final_json) "errorMessage": "Data supplied is not accepted, following characters are not allowed in the input ` $ & ( ) [ ] { } ; : ‘ < >."}
final_json = json.dumps(final_dic)
return HttpResponse(final_json)
if key.find(';') > -1 or key.find('&&') > -1 or key.find('|') > -1 or key.find('...') > -1 \ if key.find(';') > -1 or key.find('&&') > -1 or key.find('|') > -1 or key.find('...') > -1 \
or key.find("`") > -1 or key.find("$") > -1 or key.find("(") > -1 or key.find(")") > -1 \ or key.find("`") > -1 or key.find("$") > -1 or key.find("(") > -1 or key.find(")") > -1 \
or key.find("'") > -1 or key.find("[") > -1 or key.find("]") > -1 or key.find( or key.find("'") > -1 or key.find("[") > -1 or key.find("]") > -1 or key.find(