Attachment #5317 for bug #31923





	@LDAP_Connection
	def license_import( self, request, ldap_connection = None, ldap_position = None ):
		if request.command == 'UPLOAD':
			self.required_options(request, 'licenseUpload')
			filename = request.options['licenseUpload']['tmpfile']
			filename = request.options[ 0 ][ 'tmpfile' ]
			if not os.path.realpath(filename).startswith(TEMPUPLOADDIR):
				self.finished(request.id, [{'success': False, 'message': 'invalid file path'}])
				return
		else:
			self.required_options( request, 'license' )
			lic = request.options[ 'license' ]

Lines 125-130 Link Here

(-)univention-management-console-frontend/umc/widgets/Uploader.js (+1 lines)
125	this._uploader = new dojox.form.Uploader({	125	this._uploader = new dojox.form.Uploader({
126	url: '/umcp/upload' + (this.command ? '/' + this.command : ''),	126	url: '/umcp/upload' + (this.command ? '/' + this.command : ''),
127	label: this.buttonLabel,	127	label: this.buttonLabel,
		128	name: this.name,
128	getForm: function() {	129	getForm: function() {
129	// make sure that the Uploader does not find any of our encapsulating forms	130	// make sure that the Uploader does not find any of our encapsulating forms
130	return null;	131	return null;

Return to bug 31923

Lines 223-235 Link Here

(-)univention-management-console-module-udm/umc/python/udm/__init__.py (-7 / +3 lines)
223		223
224	@LDAP_Connection	224	@LDAP_Connection
225	def license_import( self, request, ldap_connection = None, ldap_position = None ):	225	def license_import( self, request, ldap_connection = None, ldap_position = None ):
226	filename = None	226	if request.command == 'UPLOAD':
227	if isinstance(request.options, (list, tuple)) and request.options:	227	self.required_options(request, 'licenseUpload')
228	# file upload	228	filename = request.options['licenseUpload']['tmpfile']
229	filename = request.options[ 0 ][ 'tmpfile' ]
230	if not os.path.realpath(filename).startswith(TEMPUPLOADDIR):
231	self.finished(request.id, [{'success': False, 'message': 'invalid file path'}])
232	return
233	else:	229	else:
234	self.required_options( request, 'license' )	230	self.required_options( request, 'license' )
235	lic = request.options[ 'license' ]	231	lic = request.options[ 'license' ]