plint

commit 07184d91212fb2b3fab7df9367e7549395a2504d
parent 2f4f1336a65a0781b25eeb3485e2ff6810e4ca1b
Author: Antoine Amarilli <a3nm@a3nm.net>
Date:   Tue,  5 Apr 2016 20:38:58 +0200

fix directory traversal security error

thanks: ZadYree

Diffstat:
plint_web.py
 | 
3
++-

1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/plint_web.py b/plint_web.py
@@ -148,7 +148,8 @@ def q(lang):
     else:
       msg = "Poem is empty, too long, or has too long lines"
     return dumps({'error': msg})
-  templateName = request.forms.get('template')
+  templateName = re.sub(r'[^a-z_]', '', request.forms.get('template'))
+  print(templateName)
   if templateName == 'custom':
     x = request.forms.get('custom_template')
   else: