From 30ed6daa26f623e37b958cd2c63bf79e35134c0c Mon Sep 17 00:00:00 2001 From: Aevann1 Date: Fri, 17 Jun 2022 20:36:34 +0200 Subject: [PATCH] fix RCE, thank you @Camas --- files/helpers/media.py | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/files/helpers/media.py b/files/helpers/media.py index cd7fb62bf..f935ad340 100644 --- a/files/helpers/media.py +++ b/files/helpers/media.py @@ -10,7 +10,7 @@ from .const import * def process_audio(file): - name = f'/audio/{time.time()}'.replace('.','') + '.' + file.filename.split('.')[-1].lower() + name = f'/audio/{time.time()}'.replace('.','') + '.mp3' file.save(name) if os.stat(name).st_size > 8 * 1024 * 1024: @@ -24,8 +24,7 @@ def process_audio(file): def process_video(file): old = f'/videos/{time.time()}'.replace('.','') - extension = file.filename.split('.')[-1].lower() - new = old + '.' + extension + new = old + '.mp4' if extension == 'webm': file.save(new) @@ -71,4 +70,4 @@ def process_image(patron, filename=None, resize=0): i = ImageOps.exif_transpose(i) i.save(filename, format="WEBP", method=6) - return filename \ No newline at end of file + return filename