mirror of
https://github.com/esphome/esphome.git
synced 2024-11-10 09:17:46 +01:00
Merge pull request from GHSA-8p25-3q46-8q2p
This commit is contained in:
parent
84c6e52be2
commit
d814ed1d4a
1 changed files with 19 additions and 5 deletions
|
@ -806,8 +806,16 @@ class EditRequestHandler(BaseHandler):
|
|||
@bind_config
|
||||
async def get(self, configuration: str | None = None) -> None:
|
||||
"""Get the content of a file."""
|
||||
loop = asyncio.get_running_loop()
|
||||
if not configuration.endswith((".yaml", ".yml")):
|
||||
self.send_error(404)
|
||||
return
|
||||
|
||||
filename = settings.rel_path(configuration)
|
||||
if Path(filename).resolve().parent != settings.absolute_config_dir:
|
||||
self.send_error(404)
|
||||
return
|
||||
|
||||
loop = asyncio.get_running_loop()
|
||||
content = await loop.run_in_executor(
|
||||
None, self._read_file, filename, configuration
|
||||
)
|
||||
|
@ -833,11 +841,17 @@ class EditRequestHandler(BaseHandler):
|
|||
@bind_config
|
||||
async def post(self, configuration: str | None = None) -> None:
|
||||
"""Write the content of a file."""
|
||||
if not configuration.endswith((".yaml", ".yml")):
|
||||
self.send_error(404)
|
||||
return
|
||||
|
||||
filename = settings.rel_path(configuration)
|
||||
if Path(filename).resolve().parent != settings.absolute_config_dir:
|
||||
self.send_error(404)
|
||||
return
|
||||
|
||||
loop = asyncio.get_running_loop()
|
||||
config_file = settings.rel_path(configuration)
|
||||
await loop.run_in_executor(
|
||||
None, self._write_file, config_file, self.request.body
|
||||
)
|
||||
await loop.run_in_executor(None, self._write_file, filename, self.request.body)
|
||||
# Ensure the StorageJSON is updated as well
|
||||
DASHBOARD.entries.async_schedule_storage_json_update(filename)
|
||||
self.set_status(200)
|
||||
|
|
Loading…
Reference in a new issue