Annikka/evennia
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Forbid /media and /static file browsing. Resolve #1746.

Browse source
This commit is contained in:
Griatch 2019-08-28 20:07:03 +02:00
parent 3af404960e
commit 0201208ec9
2 changed files with 15 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
evennia/server/server.py
View file

@ -546,7 +546,7 @@ if WEBSERVER_ENABLED:
# Start a django-compatible webserver. # Start a django-compatible webserver.
from evennia.server.webserver import DjangoWebRoot, WSGIWebServer, Website, LockableThreadPool from evennia.server.webserver import DjangoWebRoot, WSGIWebServer, Website, LockableThreadPool, PrivateStaticRoot
# start a thread pool and define the root url (/) as a wsgi resource # start a thread pool and define the root url (/) as a wsgi resource
# recognized by Django # recognized by Django
@ -555,9 +555,9 @@ if WEBSERVER_ENABLED:
web_root = DjangoWebRoot(threads) web_root = DjangoWebRoot(threads)
# point our media resources to url /media # point our media resources to url /media
web_root.putChild(b"media", static.File(settings.MEDIA_ROOT)) web_root.putChild(b"media", PrivateStaticRoot(settings.MEDIA_ROOT))
# point our static resources to url /static # point our static resources to url /static
web_root.putChild(b"static", static.File(settings.STATIC_ROOT)) web_root.putChild(b"static", PrivateStaticRoot(settings.STATIC_ROOT))
EVENNIA.web_root = web_root EVENNIA.web_root = web_root
if WEB_PLUGINS_MODULE: if WEB_PLUGINS_MODULE:

13
evennia/server/webserver.py
View file

@ -14,7 +14,7 @@ a great example/aid on how to do this.)
""" """
import urllib.parse import urllib.parse
from urllib.parse import quote as urlquote from urllib.parse import quote as urlquote
from twisted.web import resource, http, server from twisted.web import resource, http, server, static
from twisted.internet import reactor from twisted.internet import reactor
from twisted.application import internet from twisted.application import internet
from twisted.web.proxy import ReverseProxyResource from twisted.web.proxy import ReverseProxyResource
@ -268,3 +268,14 @@ class WSGIWebServer(internet.TCPServer):
""" """
super().stopService() super().stopService()
self.pool.stop() self.pool.stop()
class PrivateStaticRoot(static.File):
"""
This overrides the default static file resource so as to not make the
directory listings public (that is, if you go to /media or /static you
won't see an index of all static/media files on the server).
"""
def directoryListing(self):
return resource.ForbiddenResource()