orbit-oss/flask
4
4
Fork 2
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #1346 from ezyang/master

Browse source 
Remove bad security advice about send_file, fixes #1345
This commit is contained in:
Markus Unterwaditzer 2015-02-08 13:42:37 +01:00
commit 6521c36c68
1 changed files with 2 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

8
flask/helpers.py
View file

@ -427,12 +427,8 @@ def send_file(filename_or_fp, mimetype=None, as_attachment=False,
guessing requires a `filename` or an `attachment_filename` to be
provided.
Please never pass filenames to this function from user sources without
checking them first. Something like this is usually sufficient to
avoid security problems::
if '..' in filename or filename.startswith('/'):
abort(404)
Please never pass filenames to this function from user sources;
you should use :func:`send_from_directory` instead.
.. versionadded:: 0.2