mirrors/cosmopolitan
1
0
Fork 0
mirror of https://github.com/jart/cosmopolitan.git synced 2025-08-07 02:10:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update documentation on required asset permissions (closes #335)

Browse source
This commit is contained in:
Paul Kulchenko 2021-12-06 22:00:54 -08:00
parent d6a039821f
commit bb4ff2411e
2 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tool/net/help.txt
View file

@ -959,6 +959,10 @@ FUNCTIONS
request routing needed for serving assets. This function returns
true if the request was resolved. If it was resolved, then your
OnHttpRequest request handler can still set additional headers.
Note that the asset needs to have "read other" permissions;
otherwise this function logs a warning and returns 403 Forbidden.
If this is undesirable, use GetAssetMode and ServeAsset to bypass
the check.
ServeAsset(path:str)
Instructs redbean to serve static asset at path. This function

3
tool/net/redbean.c
View file

@ -6200,6 +6200,9 @@ static char *RoutePath(const char *path, size_t pathlen) {
struct Asset *a;
DEBUGF("(srvr) RoutePath(%`'.*s)", pathlen, path);
if ((a = GetAsset(path, pathlen))) {
// only allow "read other" permissions for security
// and consistency with handling of "external" files
// in this and other webservers
if ((m = GetMode(a)) & 0004) {
if (!S_ISDIR(m)) {
return HandleAsset(a, path, pathlen);