Increment version to 1.4

README.md

@@ -1,4 +1,4 @@
-![Version 1.0](http://img.shields.io/badge/version-v1.0-green.svg)
+![Version 1.4](http://img.shields.io/badge/version-v1.4-green.svg)
 ![Python 3.8](http://img.shields.io/badge/python-3.8-blue.svg)
 [![MIT License](http://img.shields.io/badge/license-MIT%20License-blue.svg)](https://github.com/sc0tfree/updog/blob/master/LICENSE)
 [![sc0tfree Twitter](http://img.shields.io/twitter/url/http/shields.io.svg?style=social&label=Follow)](https://twitter.com/sc0tfree)

updog/__init__.py

@@ -1,4 +1,4 @@
-version_info = (1,0)
+version_info = (1,4)
 version = '.'.join(str(c) for c in version_info)
 
 base_directory = ''

updog/__main__.py

@@ -8,7 +8,7 @@ from werkzeug.utils import secure_filename
 from werkzeug.security import generate_password_hash, check_password_hash
 from werkzeug.serving import run_simple
 
-from updog.utils.path import is_valid_subpath, get_parent_directory, process_files
+from updog.utils.path import is_valid_subpath, is_valid_upload_path, get_parent_directory, process_files
 from updog.utils.output import error, info, warn, success
 from updog import version as VERSION
 
@@ -37,6 +37,9 @@ def parse_arguments():
 
     args = parser.parse_args()
 
+    # Normalize the path
+    args.directory = os.path.abspath(args.directory)
+
     return args
 
 
@@ -126,7 +129,7 @@ def main():
 
             path = request.form['path']
             # Prevent file upload to paths outside of base directory
-            if not is_valid_subpath(path, base_directory):
+            if not is_valid_upload_path(path, base_directory):
                 return redirect(request.referrer)
 
             for file in request.files.getlist('file'):

updog/utils/path.py

@@ -9,6 +9,13 @@ def is_valid_subpath(relative_directory, base_directory):
     return os.path.commonprefix([base_directory, in_question]) == base_directory
 
 
+def is_valid_upload_path(path, base_directory):
+    if path == '':
+        return False
+    in_question = os.path.abspath(path)
+    return os.path.commonprefix([base_directory, in_question]) == base_directory
+
+
 def get_relative_path(file_path, base_directory):
     return file_path.split(os.path.commonprefix([base_directory, file_path]))[1][1:]