Disable directory listings (fix traccar#4701)

anaice · Jun 20, 2021 · f2c9499 · f2c9499
1 parent cfe72dc
commit f2c9499
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 9 deletions.
diff --git a/src/main/java/org/traccar/api/MediaFilter.java b/src/main/java/org/traccar/api/MediaFilter.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2018 Anton Tananaev ([email protected])
+ * Copyright 2018 - 2021 Anton Tananaev ([email protected])
  * Copyright 2018 Andrey Kunitsyn ([email protected])
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -62,20 +62,17 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
             }
 
             String path = ((HttpServletRequest) request).getPathInfo();
-            String[] parts = path.split("/");
-            if (parts.length < 2 || parts.length == 2 && !path.endsWith("/")) {
-                Context.getPermissionsManager().checkAdmin(userId);
-            } else {
+            String[] parts = path != null ? path.split("/") : null;
+            if (parts != null && parts.length >= 2) {
                 Device device = Context.getDeviceManager().getByUniqueId(parts[1]);
                 if (device != null) {
                     Context.getPermissionsManager().checkDevice(userId, device.getId());
-                } else {
-                    httpResponse.sendError(HttpServletResponse.SC_NOT_FOUND);
+                    chain.doFilter(request, response);
                     return;
                 }
             }
 
-            chain.doFilter(request, response);
+            httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN);
         } catch (SecurityException e) {
             httpResponse.setStatus(HttpServletResponse.SC_FORBIDDEN);
             httpResponse.getWriter().println(Log.exceptionStack(e));

diff --git a/src/main/java/org/traccar/web/WebServer.java b/src/main/java/org/traccar/web/WebServer.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012 - 2020 Anton Tananaev ([email protected])
+ * Copyright 2012 - 2021 Anton Tananaev ([email protected])
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -136,6 +136,7 @@ public void doScope(
     private void initWebApp(Config config, ServletContextHandler servletHandler) {
         ServletHolder servletHolder = new ServletHolder(DefaultServlet.class);
         servletHolder.setInitParameter("resourceBase", new File(config.getString(Keys.WEB_PATH)).getAbsolutePath());
+        servletHolder.setInitParameter("dirAllowed", "false");
         if (config.getBoolean(Keys.WEB_DEBUG)) {
             servletHandler.setWelcomeFiles(new String[] {"debug.html", "index.html"});
         } else {