fix hidden files

src/gossa.go

@@ -175,11 +175,11 @@ func rpc(w http.ResponseWriter, r *http.Request) {
 }
 
 func checkPath(p string) string {
-	p = filepath.Join(initPath, strings.TrimPrefix(p, *extraPath))
-	fp, err := filepath.Abs(p)
+	joined := filepath.Join(initPath, strings.TrimPrefix(p, *extraPath))
+	fp, err := filepath.Abs(joined)
 	sl, _ := filepath.EvalSymlinks(fp)
 
-	if err != nil || !strings.HasPrefix(fp, initPath) || len(sl) > 0 && !*symlinks && !strings.HasPrefix(sl, initPath) {
+	if err != nil || !strings.HasPrefix(fp, initPath) || *skipHidden && strings.Contains(p, "/.") || !*symlinks && len(sl) > 0 && !strings.HasPrefix(sl, initPath) {
 		panic(errors.New("invalid path"))
 	}
 

src/gossa_test.go

@@ -84,7 +84,7 @@ func fetchAndTestDefault(t *testing.T, url string) string {
 	return bodyStr
 }
 
-func doTest(t *testing.T, url string, symlinkEnabled bool) {
+func doTest(t *testing.T, url string, testExtra bool) {
 	payload := ""
 	path := ""
 	bodyStr := ""
@@ -202,16 +202,16 @@ func doTest(t *testing.T, url string, symlinkEnabled bool) {
 	}
 
 	// ~~~~~~~~~~~~~~~~~
-	fmt.Println("\r\n~~~~~~~~~~ test symlink, should succeed: ", symlinkEnabled)
+	fmt.Println("\r\n~~~~~~~~~~ test symlink, should succeed: ", testExtra)
 	bodyStr = get(t, url+"/support/readme.md")
 	hasReadme := strings.Contains(bodyStr, `the master branch is automatically built and pushed`)
-	if !symlinkEnabled && hasReadme {
+	if !testExtra && hasReadme {
 		t.Fatal("error symlink reached where illegal")
-	} else if symlinkEnabled && !hasReadme {
+	} else if testExtra && !hasReadme {
 		t.Fatal("error symlink unreachable")
 	}
 
-	if symlinkEnabled {
+	if testExtra {
 		fmt.Println("\r\n~~~~~~~~~~ test symlink mkdir & cleanup")
 		bodyStr = postJSON(t, url+"rpc", `{"call":"mkdirp","args":["/support/testfolder"]}`)
 		if bodyStr != `ok` {
@@ -224,6 +224,15 @@ func doTest(t *testing.T, url string, symlinkEnabled bool) {
 		}
 	}
 
+	fmt.Println("\r\n~~~~~~~~~~ test hidden file, should succeed: ", testExtra)
+	bodyStr = get(t, url+"/.testhidden")
+	hasHidden := strings.Contains(bodyStr, `test`)
+	if !testExtra && hasHidden {
+		t.Fatal("error hidden file reached where illegal")
+	} else if testExtra && !hasHidden {
+		t.Fatal("error hidden file unreachable")
+	}
+
 	//
 	fmt.Println("\r\n~~~~~~~~~~ test upload in new folder")
 	payload = "abcdef1234"