GithubBackup/MoviePilot
1
0
Fork 0
mirror of https://github.com/jxxghp/MoviePilot.git synced 2026-09-05 23:47:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3876 from InfinityPacer/feature/security

Browse Source
This commit is contained in:
jxxghp
2025-02-10 07:11:28 +08:00
committed by GitHub
parent 5e2ad34864 e48c8ee652
commit 4e69195a8d
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/core/config.py
+2 -1
View File
@@ -243,7 +243,8 @@ class ConfigModel(BaseModel):
"hdslb.com", "hdslb.com",
"cmvideo.cn", "cmvideo.cn",
"ykimg.com", "ykimg.com",
"qpic.cn"] "qpic.cn",
"http://wapx.cmvideo.cn:8080"]
) )
# 允许的图片文件后缀格式 # 允许的图片文件后缀格式
SECURITY_IMAGE_SUFFIXES: List[str] = Field( SECURITY_IMAGE_SUFFIXES: List[str] = Field(
app/utils/security.py
+1 -2
View File
@@ -65,7 +65,6 @@ class SecurityUtils:
netloc = parsed_url.netloc.lower() netloc = parsed_url.netloc.lower()
if not netloc: if not netloc:
return False return False
netloc_no_port = netloc.split(":")[0]
# 检查每个允许的域名 # 检查每个允许的域名
allowed_domains = {d.lower() for d in allowed_domains} allowed_domains = {d.lower() for d in allowed_domains}
@@ -79,7 +78,7 @@ class SecurityUtils:
return True return True
else: else:
# 非严格模式下，允许子域名匹配 # 非严格模式下，允许子域名匹配
if netloc_no_port == allowed_netloc or netloc_no_port.endswith('.' + allowed_netloc): if netloc == allowed_netloc or netloc.endswith('.' + allowed_netloc):
return True return True
return False return False