Commit dbac5d20 authored by Markus Scheidgen's avatar Markus Scheidgen
Browse files

Do not list always restricted files.

parent 40a25ab6
Pipeline #62467 passed with stages
in 23 minutes and 4 seconds
......@@ -808,7 +808,8 @@ class PublicUploadFiles(UploadFiles):
content_path = path[directory_len + (0 if directory_len == 0 else 1):]
if path.startswith(directory) and '/' not in content_path:
if '/' not in content_path:
results.append((content_path, zf.getinfo(path).file_size))
if not always_restricted(content_path) or self._is_authorized:
results.append((content_path, zf.getinfo(path).file_size))
# this asserts that sub directories are always behind their
# parents and file siblings
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment