diff --git a/CHANGELOG.md b/CHANGELOG.md index f5c1b234e0f6713563aa400c7db592c4129cfc1e..99adca888517f470385f422cf3ef55ccb87ea642 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ TBD - Change hour and minute intervals in APScheudler to fix incorrect triggers ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/910)) - Use asyncio locks to limit upload handler race condition ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/907)) - Fix static fonts not working on some browsers ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/906)) +- Fix import directory cleanup was not pointing to the proper directory ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/918)) ### Tweaks TBD ### Lang diff --git a/app/classes/shared/tasks.py b/app/classes/shared/tasks.py index 7be22c730a7de8c59c63143682f2438d9c56c352..4134a63454bf566c61bc66f5b76f3a55095bdd57 100644 --- a/app/classes/shared/tasks.py +++ b/app/classes/shared/tasks.py @@ -5,6 +5,7 @@ import threading import asyncio import datetime import json +from pathlib import Path from zoneinfo import ZoneInfoNotFoundError from tzlocal import get_localzone from apscheduler.events import EVENT_JOB_EXECUTED @@ -815,15 +816,16 @@ class TasksManager: os.remove(os.path.join(file)) except FileNotFoundError: logger.debug("Could not clear out file from temp directory") - - for file in os.listdir( - os.path.join(self.controller.project_root, "import", "upload") - ): - if self.helper.is_file_older_than_x_days( - os.path.join(self.controller.project_root, "import", "upload", file) - ): + import_path = Path(self.controller.project_root, "import", "upload") + for file in os.listdir(import_path): + file_path = Path(import_path, file).resolve(strict=True) + if not self.helper.validate_traversal(import_path, file_path): + logger.error( + "Traversal detected while deleting import file %s", file_path + ) + if self.helper.is_file_older_than_x_days(file_path): try: - os.remove(os.path.join(file)) + os.remove(file_path) except FileNotFoundError: logger.debug("Could not clear out file from import directory")