Allow admin ONLY from the host device. Rules: - Host header must be local (localhost / loopback / this device LAN IP) - Client IP must also be local (loopback / this device LAN IP) This blocks remote admin usage through LAN peers, cloudflared, Tor, etc.
()
| 3601 | """ |
| 3602 | p = (p or "").replace("\\", "/").strip() |
| 3603 | if p in ("", ".", "/"): |
| 3604 | return "" |
| 3605 | p = p.lstrip("/") |
| 3606 | parts = [] |
| 3607 | for part in p.split("/"): |
| 3608 | if part in ("", "."): |
| 3609 | continue |
| 3610 | if part == "..": |
| 3611 | raise ValueError("Path traversal") |
| 3612 | parts.append(part) |
| 3613 | return "/".join(parts) |
| 3614 | |
| 3615 | def abs_user_path(username: str, rel: str) -> str: |
| 3616 | """Resolve a vault path and prevent traversal through ``..`` or symlinks.""" |
| 3617 | rel = safe_relpath(rel) |
| 3618 | root = user_root(username) |
| 3619 | root_real = os.path.realpath(root) |
| 3620 | ap = os.path.realpath(os.path.join(root_real, rel)) |
| 3621 | if not (ap == root_real or ap.startswith(root_real + os.sep)): |
| 3622 | raise ValueError("Bad path") |
| 3623 | return ap |
| 3624 | |
| 3625 | |
| 3626 | |
| 3627 | def fast_save(file_storage, dest_path: str, bufsize: int = 64 * 1024 * 1024): |
| 3628 | # Fast chunked saving for large uploads. |
| 3629 | # Bigger buffer + buffered writer improves throughput on many devices. |
| 3630 | """fast_save. |
| 3631 | |
| 3632 | Route handler or application helper. |
| 3633 | |
| 3634 | This docstring was expanded to make future maintenance easier. |
nothing calls this directly
no test coverage detected