Mercurial > hg > orthanc

comparison OrthancServer/Plugins/Samples/AdvancedStorage/Plugin.cpp @ 5082:4af5f496a0dd attach-custom-data

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
fix
author Alain Mazy <am@osimis.io>
date Wed, 14 Sep 2022 17:11:05 +0200
parents c673997507ea
children 79f98ee4f04b
comparison
equal deleted inserted replaced
5081:c673997507ea 5082:4af5f496a0dd
287 fs::path path = rootPath / relativePath; 287 fs::path path = rootPath / relativePath;
288 288
289 LOG(INFO) << "Advanced Storage - creating attachment \"" << uuid << "\" of type " << static_cast<int>(type) << " (path = " + path.string() + ")"; 289 LOG(INFO) << "Advanced Storage - creating attachment \"" << uuid << "\" of type " << static_cast<int>(type) << " (path = " + path.string() + ")";
290 290
291 // check that the final path is not 'above' the root path (this could happen if e.g., a PatientName is ../../../../toto) 291 // check that the final path is not 'above' the root path (this could happen if e.g., a PatientName is ../../../../toto)
292 std::string canonicalPath = fs::canonical(path).string(); 292 // fs::canonical() can not be used for that since the file needs to exist
293 if (!Orthanc::Toolbox::StartsWith(canonicalPath, rootPath.string())) 293 // so far, we'll just forbid path containing '..' since they might be suspicious
294 { 294 if (path.string().find("..") != std::string::npos)
295 throw Orthanc::OrthancException(Orthanc::ErrorCode_InternalError, std::string("Advanced Storage - final path is above root: '") + canonicalPath + "' - '" + rootPath.string() + "'") ; 295 {
296 fs::path legacyPath = rootPath / GetLegacyRelativePath(uuid);
297 LOG(WARNING) << "Advanced Storage - WAS02 - Path is suspicious since it contains '..': '" << path.string() << "' will be stored in '" << legacyPath << "'";
298 path = legacyPath;
296 } 299 }
297 300
298 // check path length !!!!!, if too long, go back to legacy path and issue a warning 301 // check path length !!!!!, if too long, go back to legacy path and issue a warning
299 if (path.string().size() > maxPathLength_) 302 if (path.string().size() > maxPathLength_)
300 { 303 {