]> git.proxmox.com Git - pve-http-server.git/commit
projects / pve-http-server.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: a2a3d17) | patch
explicitly disallow tmpfilename parameter in query URL
authorThomas Lamprecht <t.lamprecht@proxmox.com>
Fri, 14 Apr 2023 14:09:07 +0000 (16:09 +0200)
committerThomas Lamprecht <t.lamprecht@proxmox.com>
Fri, 14 Apr 2023 14:22:40 +0000 (16:22 +0200)
commitcb53bd68615f8119c8915608455df63951abc26f
tree14b91d606058031d4b71d1e85de77b283df43626tree
parenta2a3d17be8548e47d0bc3a09a325a89dbfad487fcommit | diff
explicitly disallow tmpfilename parameter in query URL

This is an internal parameter and we pass the actual internal one
around via the $reqstate variable, so avoid confusion and return a
clear error if a POST request sets this query parameter.

Reported-by: Friedrich Weber <f.weber@proxmox.com>
Suggested-by: Friedrich Weber <f.weber@proxmox.com>
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
src/PVE/APIServer/AnyEvent.pm diff | blob | blame | history
PVE HTTP Server