Merge pull request #1051 from markbastiaans/fix-realpath-checks

Fix checks with os.path.realpath() for systems with symlinked paths

AUTHORS.md

@@ -53,6 +53,7 @@ date of first contribution):
   * [Andrew Erickson](https://github.com/aerickson)
   * [Nicanor Romero Venier](https://github.com/nicanor-romero)
   * [Thomas Hou](https://github.com/masterhou)
+  * [Mark Bastiaans](https://github.com/markbastiaans)
 
 OctoPrint started off as a fork of [Cura](https://github.com/daid/Cura) by
 [Daid Braam](https://github.com/daid). Parts of its communication layer and

src/octoprint/settings.py

@@ -1072,7 +1072,7 @@ class Settings(object):
 	def saveScript(self, script_type, name, script):
 		script_folder = self.getBaseFolder("scripts")
 		filename = os.path.realpath(os.path.join(script_folder, script_type, name))
-		if not filename.startswith(script_folder):
+		if not filename.startswith(os.path.realpath(script_folder)):
 			# oops, jail break, that shouldn't happen
 			raise ValueError("Invalid script path to save to: {filename} (from {script_type}:{name})".format(**locals()))
 

src/octoprint/slicing/__init__.py

@@ -585,7 +585,7 @@ class SlicingManager(object):
 		name = self._sanitize(name)
 
 		path = os.path.join(self.get_slicer_profile_path(slicer), "{name}.profile".format(name=name))
-		if not os.path.realpath(path).startswith(self._profile_path):
+		if not os.path.realpath(path).startswith(os.path.realpath(self._profile_path)):
 			raise IOError("Path to profile {name} tried to break out of allows sub path".format(**locals()))
 		if must_exist and not (os.path.exists(path) and os.path.isfile(path)):
 			raise UnknownProfile(slicer, name)