From 5bee927481c680a2d72d33e886eb4e9960f4dffc Mon Sep 17 00:00:00 2001 From: Julien Duponchelle Date: Thu, 4 Feb 2016 11:46:05 +0100 Subject: [PATCH] Disallow creating project with " in the path It's not supported by dynamips. Fix https://github.com/GNS3/gns3-gui/issues/987 --- gns3server/modules/project.py | 5 ++++- tests/modules/test_project.py | 7 +++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/gns3server/modules/project.py b/gns3server/modules/project.py index 26604066..8682490b 100644 --- a/gns3server/modules/project.py +++ b/gns3server/modules/project.py @@ -141,7 +141,10 @@ class Project: if hasattr(self, "_path"): if path != self._path and self.is_local() is False: - raise aiohttp.web.HTTPForbidden(text="You are not allowed to modify the project directory location") + raise aiohttp.web.HTTPForbidden(text="You are not allowed to modify the project directory path") + + if '"' in path: + raise aiohttp.web.HTTPForbidden(text="You are not allowed to use \" in the project directory path. It's not supported by Dynamips.") self._path = path self._update_temporary_file() diff --git a/tests/modules/test_project.py b/tests/modules/test_project.py index 1ee24fe1..1a9a1b93 100644 --- a/tests/modules/test_project.py +++ b/tests/modules/test_project.py @@ -102,6 +102,13 @@ def test_changing_path_not_allowed(tmpdir): p.path = str(tmpdir) +def test_changing_path_with_quote_not_allowed(tmpdir): + with patch("gns3server.modules.project.Project.is_local", return_value=True): + with pytest.raises(aiohttp.web.HTTPForbidden): + p = Project() + p.path = str(tmpdir / "project\"53") + + def test_json(tmpdir): p = Project() assert p.__json__() == {"name": p.name, "location": p.location, "path": p.path, "project_id": p.id, "temporary": False}