You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I've now been bitten by this on multiple occasions - the archive path is not treated the same as other paths. It does not consider the base-directory (#2398), it does not support variable substitution consistently (also #2398), and it does not always handle path restriction (#3359). My use case is keeping the archive located with the downloaded files, as I may use different hosts to download to a common location (i.e. stored on a NAS).
The text was updated successfully, but these errors were encountered:
Okay, how do you end up in a situation where you would need to rely on "path-restrict" for the archive path setting?
Who or what is writing your config file?
If something hits the filesystem, then it needs to be path restricted. The bug report above includes an example of this not happening; i.e. a variable has a "/" in it, which causes the archive to end up in the wrong place because it doesn't sanitize the path properly.
This is basic input sanitization. If you're touching the filesystem, you must sanitize (or "path restrict" in your parlance) for filesystem-valid characters. Anything else is simply incorrect.
I've now been bitten by this on multiple occasions - the archive path is not treated the same as other paths. It does not consider the base-directory (#2398), it does not support variable substitution consistently (also #2398), and it does not always handle path restriction (#3359). My use case is keeping the archive located with the downloaded files, as I may use different hosts to download to a common location (i.e. stored on a NAS).
The text was updated successfully, but these errors were encountered: