코드 노출 방지 패치

route/main_image_view.py

@@ -4,10 +4,11 @@ from . import main_error_404
 def main_image_view_2(conn, name, app_var):
     curs = conn.cursor()
 
-    if os.path.exists(os.path.join(app_var['path_data_image'], name)):
+    mime_type = re.search(r'([^.]+)$', name)
+    if mime_type:
         return flask.send_from_directory(
             './' + app_var['path_data_image'], name, 
-            mimetype = 'image/' + re.search(r'\.([^\.]+)$', name).group(1)
+            mimetype = 'image/' + mime_type.group(1).lower()
         )
     else:
         return main_error_404.main_error_404_2(conn)

route/main_views.py

@@ -1,28 +1,34 @@
 from .tool.func import *
+from . import main_error_404
 
 def main_views_2(conn, name):
     curs = conn.cursor()
 
-    if re.search(r'\/', name):
-        m = re.search(r'^(.*)\/(.*)$', name)
-        if m:
-            n = m.groups()
-            plus = '/' + n[0]
-            rename = n[1]
-        else:
-            plus = ''
-            rename = name
+    file_name = re.search(r'([^/]+)$', name)
+    if not file_name:
+        return main_error_404.main_error_404_2(conn)
     else:
-        plus = ''
-        rename = name
+        file_name = file_name.group(1)
+        dir_name = './views/' + re.sub(r'\.{2,}', '', re.sub(r'([^/]+)$', '', name))
 
-    mime_type = re.search(r'\.([^\.]+)$', rename).group(1)
-    if mime_type:
-        if mime_type in ['.jpeg', '.jpg', '.gif', '.png', '.webp', '.JPEG', '.JPG', '.GIF', '.PNG', '.WEBP']:
-            mime_type = 'image/' + mime_type
+        mime_type = re.search(r'([^.]+)$', file_name)
+        image_type = [
+            '.jpeg', 
+            '.jpg', 
+            '.gif', 
+            '.png', 
+            '.webp'
+        ]
+        if mime_type:
+            mime_type = mime_type.group(1).lower()
+            if mime_type in image_type:
+                mime_type = 'image/' + mime_type
+            else:
+                mime_type = 'text/' + mime_type
         else:
-            mime_type = 'text/' + mime_type
-    else:
-        mime_type = 'text/plain'
+            mime_type = 'text/plain'
 
-    return flask.send_from_directory('./views' + plus, rename, mimetype = mime_type)
+        return flask.send_from_directory(
+            dir_name, file_name, 
+            mimetype = mime_type
+        )

version.json

@@ -1,6 +1,6 @@
 {
     "beta" : {
-        "r_ver" : "v3.2.0-beta-28 (v3.2.0-dev-2020-08-24-03)",
+        "r_ver" : "v3.2.0-beta-28 (v3.2.0-dev-2020-08-24-04)",
         "c_ver" : "3202600",
         "s_ver" : "9"
     }