From 146128730cfaf359dca5b92512e91e06111cc88b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gina=20H=C3=A4u=C3=9Fge?= Date: Mon, 19 Jan 2015 12:34:25 +0100 Subject: [PATCH] Fixed timelapse deletion Was broken after switching to new file name sanitizing with the new file management layer, still stripped everything but ascii from the filename although timelapse file names may actually contain more than that character set since the gcode file names they are based off may too. Closes #724 --- src/octoprint/server/api/timelapse.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/octoprint/server/api/timelapse.py b/src/octoprint/server/api/timelapse.py index 11f27e5b..f3c7a2c1 100644 --- a/src/octoprint/server/api/timelapse.py +++ b/src/octoprint/server/api/timelapse.py @@ -56,9 +56,10 @@ def downloadTimelapse(filename): @restricted_access def deleteTimelapse(filename): if util.isAllowedFile(filename, {"mpg"}): - secure = os.path.join(settings().getBaseFolder("timelapse"), secure_filename(filename)) - if os.path.exists(secure): - os.remove(secure) + timelapse_folder = settings().getBaseFolder("timelapse") + full_path = os.path.realpath(os.path.join(timelapse_folder, filename)) + if full_path.startswith(timelapse_folder) and os.path.exists(full_path): + os.remove(full_path) return getTimelapseData()