app/vmstorage: fix potential file inclusion via variable (#3339)

* app/vmstorage: fix potential file inclusion via variable

* app/vmstorage: cleanup
This commit is contained in:
Dmytro Kozlov 2022-11-17 01:29:43 +02:00 committed by GitHub
parent a21c8e7b9a
commit fb65fb39d2
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -333,12 +333,27 @@ func RequestHandler(w http.ResponseWriter, r *http.Request) bool {
case "/delete":
w.Header().Set("Content-Type", "application/json")
snapshotName := r.FormValue("snapshot")
if err := Storage.DeleteSnapshot(snapshotName); err != nil {
err = fmt.Errorf("cannot delete snapshot %q: %w", snapshotName, err)
snapshots, err := Storage.ListSnapshots()
if err != nil {
err = fmt.Errorf("cannot list snapshots: %w", err)
jsonResponseError(w, err)
return true
}
fmt.Fprintf(w, `{"status":"ok"}`)
for _, snName := range snapshots {
if snName == snapshotName {
if err := Storage.DeleteSnapshot(snName); err != nil {
err = fmt.Errorf("cannot delete snapshot %q: %w", snName, err)
jsonResponseError(w, err)
return true
}
fmt.Fprintf(w, `{"status":"ok"}`)
return true
}
}
err = fmt.Errorf("cannot find snapshot %q: %w", snapshotName, err)
jsonResponseError(w, err)
return true
case "/delete_all":
w.Header().Set("Content-Type", "application/json")