pegasus/weechat
1
0
Fork 0
mirror of https://github.com/weechat/weechat.git synced 2026-06-24 20:06:38 +02:00
Code Activity

xfer: replace directory separator in remote nick by underscore in download filename (#2321)

Browse Source
This commit is contained in:
aizu-m
2026-06-02 12:31:10 +05:30
committed by Sébastien Helleu
parent 03a6d9306a
commit 75b72e7f69
2 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+1
View File
@@ -15,6 +15,7 @@
- api, relay: fix timing attack on TOTP validation ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc))
- relay: limit size of decompressed websocket frame with permessage-deflate to prevent memory exhaustion ([GHSA-v2v4-45wm-5cr3](https://github.com/weechat/weechat/security/advisories/GHSA-v2v4-45wm-5cr3))
- relay/weechat: fix empty buffers in client when WeeChat is running on Solaris/illumos
- xfer: replace directory separator in remote nick by underscore in download filename to prevent writing the file outside the download directory ([#2321](https://github.com/weechat/weechat/issues/2321))
- build: fix build on Solaris/illumos (issue #2251)
## Version 4.6.3 (2025-05-11)
src/plugins/xfer/xfer-file.c
+11 -3
View File
@@ -249,7 +249,7 @@ xfer_file_find_suffix (struct t_xfer *xfer)
void
xfer_file_find_filename (struct t_xfer *xfer)
{
char *dir_separator, *path;
char *dir_separator, *path, *nick;
struct t_hashtable *options;
if (!XFER_IS_FILE(xfer->type))
@@ -285,12 +285,20 @@ xfer_file_find_filename (struct t_xfer *xfer)
{
strcat (xfer->local_filename, dir_separator);
}
free (dir_separator);
if (weechat_config_boolean (xfer_config_file_use_nick_in_filename))
{
strcat (xfer->local_filename, xfer->remote_nick);
/*
* the remote nick comes from the server and can contain a directory
* separator: replace it so the nick cannot make the file be written
* outside the download directory
*/
nick = (dir_separator) ?
weechat_string_replace (xfer->remote_nick, dir_separator, "_") : NULL;
strcat (xfer->local_filename, (nick) ? nick : xfer->remote_nick);
free (nick);
strcat (xfer->local_filename, ".");
}
free (dir_separator);
strcat (xfer->local_filename, xfer->filename);
free (path);