FOSS/AyuGramDesktop
1
0
Fork 0
mirror of https://github.com/AyuGram/AyuGramDesktop.git synced 2026-07-25 06:54:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed path traversal in bulk file download via filename sanitization.

Browse Source
This commit is contained in:
23rd
2026-03-31 13:35:57 +03:00
parent 73d0b4cb84
commit 82f9aa1a2a
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Telegram/SourceFiles/menu/menu_item_download_files.cpp
+4 -1
View File
@@ -7,6 +7,7 @@ https://github.com/telegramdesktop/tdesktop/blob/master/LEGAL
*/
#include "menu/menu_item_download_files.h"
#include "base/base_file_utilities.h"
#include "core/application.h"
#include "core/core_settings.h"
#include "core/file_utilities.h"
@@ -161,7 +162,9 @@ void AddAction(
const auto saveDocuments = [=](const QString &folderPath) {
for (const auto &[document, origin] : documents) {
if (!folderPath.isEmpty()) {
document->save(origin, folderPath + document->filename());
const auto name =
base::FileNameFromUserString(document->filename());
document->save(origin, folderPath + name);
} else {
DocumentSaveClickHandler::SaveAndTrack(origin, document);
}