Commit 1482c2be authored by Dannon Baker's avatar Dannon Baker
Browse files

Merge remote-tracking branch 'upstream/release_22.01' into release_22.05

parents 02ff6ff7 e5e6bda4

lib/galaxy/web/framework/middleware/static.py

+5 −1
Original line number Diff line number Diff line
@@ -40,7 +40,11 @@ class CacheableStaticURLParser(StaticURLParser): 
                    directory = host_val

                    break



        full = os.path.join(directory, filename)

        full = self.normpath(os.path.join(directory, filename))

        if not full.startswith(directory):

            # Out of bounds

            return self.not_found(environ, start_response)



        if not os.path.exists(full):

            return self.not_found(environ, start_response)

        if os.path.isdir(full):