Validate destination of VirtIO ISO downloads

This commit is contained in:
bergware
2022-01-22 12:16:22 +01:00
parent e06f18124a
commit 024d53f686
@@ -427,6 +427,8 @@ case 'virtio-win-iso-download':
$arrResponse = ['error' => _('Specify a ISO storage path first')];
} elseif (!is_dir($_REQUEST['download_path'])) {
$arrResponse = ['error' => _("ISO storage path doesn't exist, please create the user share (or empty folder) first")];
} elseif (substr(realpath($_REQUEST['download_path'])?:'',0,5) != '/mnt/') {
$arrResponse = ['error' => _('Invalid storage path')];
} else {
@mkdir($_REQUEST['download_path'], 0777, true);
$_REQUEST['download_path'] = realpath($_REQUEST['download_path']).'/';