app/vmstorage: fix potential file inclusion via variable (#3339)

* app/vmstorage: fix potential file inclusion via variable

* app/vmstorage: cleanup
This commit is contained in:
Dmytro Kozlov 2022-11-17 01:29:43 +02:00 committed by Aliaksandr Valialkin
parent f67c2a2f8f
commit 6f7956503f
No known key found for this signature in database
GPG key ID: A72BEC6CD3D0DED1

View file

@ -241,12 +241,27 @@ func requestHandler(w http.ResponseWriter, r *http.Request, strg *storage.Storag
case "/delete":
w.Header().Set("Content-Type", "application/json")
snapshotName := r.FormValue("snapshot")
if err := strg.DeleteSnapshot(snapshotName); err != nil {
err = fmt.Errorf("cannot delete snapshot %q: %w", snapshotName, err)
snapshots, err := strg.ListSnapshots()
if err != nil {
err = fmt.Errorf("cannot list snapshots: %w", err)
jsonResponseError(w, err)
return true
}
fmt.Fprintf(w, `{"status":"ok"}`)
for _, snName := range snapshots {
if snName == snapshotName {
if err := strg.DeleteSnapshot(snName); err != nil {
err = fmt.Errorf("cannot delete snapshot %q: %w", snName, err)
jsonResponseError(w, err)
return true
}
fmt.Fprintf(w, `{"status":"ok"}`)
return true
}
}
err = fmt.Errorf("cannot find snapshot %q: %w", snapshotName, err)
jsonResponseError(w, err)
return true
case "/delete_all":
w.Header().Set("Content-Type", "application/json")