diff --git a/fsv2/fstc b/fsv2/fstc index 45a545d..e22a5f4 100644 Binary files a/fsv2/fstc and b/fsv2/fstc differ diff --git a/fsv2/handler/serverinfo.go b/fsv2/handler/serverinfo.go index 3746d8f..7bd6cd4 100644 --- a/fsv2/handler/serverinfo.go +++ b/fsv2/handler/serverinfo.go @@ -5,6 +5,7 @@ import ( "net/http" "os" "path/filepath" + "strings" "xtcfs/config" "xtcfs/util" ) @@ -32,9 +33,10 @@ func SerInfo(w http.ResponseWriter, r *http.Request) { // 监听的目录通过?p=的方式传入 urlpath := r.URL.Query().Get("p") // 防止逃逸,造成漏洞 - if urlpath == ".." { + if strings.Contains(urlpath, "../") { urlpath = "." } + // 监听的根目录 realFilePath := filepath.Join(config.G.FilePath, urlpath) // 时间目录的情况