don't use user input for repository path access
1 file changed, 2 insertions(+), 2 deletions(-)
changed files
M routes/routes.go → routes/routes.go
@@ -152,8 +152,8 @@ } func (d *deps) Archive(rc *atreugo.RequestCtx) error { repoName, _ := rc.UserValue("repoName").(string) - repoPath, _ := rc.UserValue("repoPath").(string) + repo := d.repos.BySlug[repoName] file := rc.UserValue("file").(string) if !strings.HasSuffix(file, ".tar.gz") {@@ -167,7 +167,7 @@ filename := fmt.Sprintf("%s-%s.tar.gz", repoName, ref) setContentDisposition(rc, filename) setGZipMIME(rc) - gr, err := git.Open(repoPath, ref) + gr, err := git.Open(repo.Path, ref) if err != nil { return d.NotFound(rc) }