fix: prevent CSS injection in profile banner filename filter (#9731)

* fix the invaild check * fix the insecure change
gitcoinco · Nov 26, 2021 · 876baf9 · 876baf9
1 parent 6f5fdd0
commit 876baf9
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/app/dashboard/views.py b/app/dashboard/views.py
@@ -5780,7 +5780,7 @@ def change_user_profile_banner(request):
     try:
         profile = profile_helper(handle, True)
         is_valid = request.user.profile.id == profile.id
-        if filename[0:7] != '/static' or filename.split('/')[-1] not in load_files_in_directory('wallpapers'):
+        if filename[0:19] != '/static/wallpapers/' or filename[19:] not in load_files_in_directory('wallpapers'):
             is_valid = False
         if not is_valid:
             return JsonResponse(