diff --git a/gns3server/controller/project.py b/gns3server/controller/project.py index ad058832..5f2180b4 100644 --- a/gns3server/controller/project.py +++ b/gns3server/controller/project.py @@ -816,9 +816,12 @@ class Project: await self.delete_on_computes() await self.close() try: + project_directory = get_default_project_directory() + if not os.path.commonprefix([project_directory, self.path]) == project_directory: + raise aiohttp.web.HTTPConflict(text="Project '{}' cannot be deleted because it is not in the default project directory: '{}'".format(self._name, project_directory)) shutil.rmtree(self.path) except OSError as e: - raise aiohttp.web.HTTPConflict(text="Can not delete project directory {}: {}".format(self.path, str(e))) + raise aiohttp.web.HTTPConflict(text="Cannot delete project directory {}: {}".format(self.path, str(e))) async def delete_on_computes(self): """ diff --git a/gns3server/handlers/api/controller/project_handler.py b/gns3server/handlers/api/controller/project_handler.py index e27c43ec..50a82440 100644 --- a/gns3server/handlers/api/controller/project_handler.py +++ b/gns3server/handlers/api/controller/project_handler.py @@ -204,11 +204,12 @@ class ProjectHandler: controller = Controller.instance() config = Config.instance() + dot_gns3_file = request.json.get("path") if config.get_section_config("Server").getboolean("local", False) is False: - log.error("Can't load the project the server is not started with --local") + log.error("Cannot load '{}' because the server has not been started with the '--local' parameter".format(dot_gns3_file)) response.set_status(403) return - project = await controller.load_project(request.json.get("path"),) + project = await controller.load_project(dot_gns3_file,) response.set_status(201) response.json(project)