Merge branch 'develop' of https://github.com/PrismLauncher/PrismLauncher into filters
This commit is contained in:
@@ -240,11 +240,15 @@ bool ModrinthCreationTask::createInstance()
|
||||
auto root_modpack_url = QUrl::fromLocalFile(root_modpack_path);
|
||||
|
||||
for (auto file : m_files) {
|
||||
auto file_path = FS::PathCombine(root_modpack_path, file.path);
|
||||
auto fileName = file.path;
|
||||
#ifdef Q_OS_WIN
|
||||
fileName = FS::RemoveInvalidPathChars(fileName);
|
||||
#endif
|
||||
auto file_path = FS::PathCombine(root_modpack_path, fileName);
|
||||
if (!root_modpack_url.isParentOf(QUrl::fromLocalFile(file_path))) {
|
||||
// This means we somehow got out of the root folder, so abort here to prevent exploits
|
||||
setError(tr("One of the files has a path that leads to an arbitrary location (%1). This is a security risk and isn't allowed.")
|
||||
.arg(file.path));
|
||||
.arg(fileName));
|
||||
return false;
|
||||
}
|
||||
|
||||
@@ -257,7 +261,7 @@ bool ModrinthCreationTask::createInstance()
|
||||
// FIXME: This really needs to be put into a ConcurrentTask of
|
||||
// MultipleOptionsTask's , once those exist :)
|
||||
auto param = dl.toWeakRef();
|
||||
connect(dl.get(), &NetAction::failed, [this, &file, file_path, param] {
|
||||
connect(dl.get(), &Task::failed, [this, &file, file_path, param] {
|
||||
auto ndl = Net::ApiDownload::makeFile(file.downloads.dequeue(), file_path);
|
||||
ndl->addValidator(new Net::ChecksumValidator(file.hashAlgorithm, file.hash));
|
||||
m_files_job->addNetAction(ndl);
|
||||
|
||||
@@ -200,7 +200,7 @@ void ModrinthPackExportTask::buildZip()
|
||||
{
|
||||
setStatus(tr("Adding files..."));
|
||||
|
||||
auto zipTask = makeShared<MMCZip::ExportToZipTask>(output, gameRoot, files, "overrides/", true);
|
||||
auto zipTask = makeShared<MMCZip::ExportToZipTask>(output, gameRoot, files, "overrides/", true, true);
|
||||
zipTask->addExtraFile("modrinth.index.json", generateIndex());
|
||||
|
||||
zipTask->setExcludeFiles(resolvedFiles.keys());
|
||||
|
||||
@@ -18,6 +18,7 @@
|
||||
*/
|
||||
|
||||
#include "ModrinthPackIndex.h"
|
||||
#include "FileSystem.h"
|
||||
#include "ModrinthAPI.h"
|
||||
|
||||
#include "Json.h"
|
||||
@@ -222,6 +223,9 @@ auto Modrinth::loadIndexedPackVersion(QJsonObject& obj, QString preferred_hash_t
|
||||
if (parent.contains("url")) {
|
||||
file.downloadUrl = Json::requireString(parent, "url");
|
||||
file.fileName = Json::requireString(parent, "filename");
|
||||
#ifdef Q_OS_WIN
|
||||
file.fileName = FS::RemoveInvalidPathChars(file.fileName);
|
||||
#endif
|
||||
file.is_preferred = Json::requireBoolean(parent, "primary") || (files.count() == 1);
|
||||
auto hash_list = Json::requireObject(parent, "hashes");
|
||||
|
||||
|
||||
Reference in New Issue
Block a user