kaboomserver/server
1
0
Fork 0
mirror of https://github.com/kaboomserver/server.git synced 2025-08-05 12:22:59 +00:00
Code Issues Projects Releases Wiki Activity

fix: only allow downloading from HTTP(s) protocols (#151)

Browse source
This commit is contained in:
amy 2025-01-24 13:39:49 -03:00 • committed by GitHub
parent e52f8d8de8
commit 8ddcbcd79f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
scripts/_common.sh
View file

@ -53,24 +53,30 @@ check_path() {
return 0 return 0
} }
fetch() {
curl -fL \
--proto =http,https \
"$@"
}
download() { download() {
debug "downloading $1 to $2" debug "downloading $1 to $2"
exitcode=0 exitcode=0
statuscode=0 statuscode=0
curl_params="-fL $1 -o $2 --write-out %{http_code}" curl_params="$1 -o $2 --write-out %{http_code}"
# shellcheck disable=SC2086 # Intentional # shellcheck disable=SC2086 # Intentional
if [ $_HAS_TTY = 1 ]; then if [ $_HAS_TTY = 1 ]; then
# TTY present: Enable curl's progress bar, clear it if operation successful # TTY present: Enable curl's progress bar, clear it if operation successful
tput sc 2>/dev/null || true # Save cursor pos tput sc 2>/dev/null || true # Save cursor pos
statuscode=$(curl -# $curl_params </dev/tty 3>&1) || exitcode=$? statuscode=$(fetch -# $curl_params </dev/tty 3>&1) || exitcode=$?
if [ $exitcode = 0 ]; then if [ $exitcode = 0 ]; then
(tput rc; tput ed) 2>/dev/null || true # Reset cursor pos; Clear to end (tput rc; tput ed) 2>/dev/null || true # Reset cursor pos; Clear to end
fi fi
else else
statuscode=$(curl $curl_params) || exitcode=$? statuscode=$(fetch $curl_params) || exitcode=$?
fi fi
if [ "$statuscode" = "404" ]; then if [ "$statuscode" = "404" ]; then

1
scripts/_sources/_zip.sh
View file

@ -2,6 +2,7 @@
_download_type_zip() { _download_type_zip() {
read_args url skip_404 extract read_args url skip_404 extract
require_args extract
zip_path="$(mktemp --suffix=.zip)" zip_path="$(mktemp --suffix=.zip)"