Mercurial > hg > orthanc

comparison OrthancServer/Sources/OrthancRestApi/OrthancRestResources.cpp @ 5200:f8f1c4a9a216

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
New configuration option 'RestApiWriteToFileSystemEnabled'
author Alain Mazy <am@osimis.io>
date Wed, 29 Mar 2023 11:23:37 +0200
parents 0ea402b4d901
children d0f7c742d397
comparison
equal deleted inserted replaced
5195:32df369198ac 5200:f8f1c4a9a216
426 if (call.IsDocumentation()) 426 if (call.IsDocumentation())
427 { 427 {
428 call.GetDocumentation() 428 call.GetDocumentation()
429 .SetTag("Instances") 429 .SetTag("Instances")
430 .SetSummary("Write DICOM onto filesystem") 430 .SetSummary("Write DICOM onto filesystem")
431 .SetDescription("Write the DICOM file onto the filesystem where Orthanc is running") 431 .SetDescription("Write the DICOM file onto the filesystem where Orthanc is running. This is insecure for "
432 "Orthanc servers that are remotely accessible since one could overwrite any system file. "
433 "Since Orthanc 1.12.0, this route is disabled by default and can be enabled thanks to "
434 "the `RestApiWriteToFileSystemEnabled` configuration.")
435 .AddRequestType(MimeType_PlainText, "The Lua script to be executed")
436
432 .SetUriArgument("id", "Orthanc identifier of the DICOM instance of interest") 437 .SetUriArgument("id", "Orthanc identifier of the DICOM instance of interest")
433 .AddRequestType(MimeType_PlainText, "Target path on the filesystem"); 438 .AddRequestType(MimeType_PlainText, "Target path on the filesystem");
434 return; 439 return;
435 } 440 }
436 441
437 ServerContext& context = OrthancRestApi::GetContext(call); 442 ServerContext& context = OrthancRestApi::GetContext(call);
443
444 if (!context.IsRestApiWriteToFileSystemEnabled())
445 {
446 LOG(ERROR) << "The URI /instances/../export is disallowed for security, "
447 << "check your configuration option `RestApiWriteToFileSystemEnabled`";
448 call.GetOutput().SignalError(HttpStatus_403_Forbidden);
449 return;
450 }
438 451
439 std::string publicId = call.GetUriComponent("id", ""); 452 std::string publicId = call.GetUriComponent("id", "");
440 453
441 std::string dicom; 454 std::string dicom;
442 context.ReadDicom(dicom, publicId); 455 context.ReadDicom(dicom, publicId);