Block symlink dir traversal for /static

This is in line with how it behaved before, but it was lifted a little for the project mount for Hugo Modules,
but that could create hard-to-detect loops.
This commit is contained in:
Bjørn Erik Pedersen
2019-07-25 00:12:40 +02:00
parent 87a07282a2
commit e5f2299741
24 changed files with 320 additions and 130 deletions

View File

@@ -459,9 +459,5 @@ func (f *rootMappingFile) Readdirnames(count int) ([]string, error) {
if err != nil {
return nil, err
}
dirss := make([]string, len(dirs))
for i, d := range dirs {
dirss[i] = d.Name()
}
return dirss, nil
return fileInfosToNames(dirs), nil
}