diff --git a/src/octoprint/settings.py b/src/octoprint/settings.py index 929afa24..fe608ad7 100644 --- a/src/octoprint/settings.py +++ b/src/octoprint/settings.py @@ -1107,7 +1107,7 @@ class Settings(object): def saveScript(self, script_type, name, script): script_folder = self.getBaseFolder("scripts") filename = os.path.realpath(os.path.join(script_folder, script_type, name)) - if not filename.startswith(script_folder): + if not filename.startswith(os.path.realpath(script_folder)): # oops, jail break, that shouldn't happen raise ValueError("Invalid script path to save to: {filename} (from {script_type}:{name})".format(**locals())) diff --git a/src/octoprint/slicing/__init__.py b/src/octoprint/slicing/__init__.py index 58eb5de5..448624b9 100644 --- a/src/octoprint/slicing/__init__.py +++ b/src/octoprint/slicing/__init__.py @@ -540,7 +540,7 @@ class SlicingManager(object): name = self._sanitize(name) path = os.path.join(self.get_slicer_profile_path(slicer), "{name}.profile".format(name=name)) - if not os.path.realpath(path).startswith(self._profile_path): + if not os.path.realpath(path).startswith(os.path.realpath(self._profile_path)): raise IOError("Path to profile {name} tried to break out of allows sub path".format(**locals())) if must_exist and not (os.path.exists(path) and os.path.isfile(path)): raise UnknownProfile(slicer, name)