diff --git a/src/api/main.cpp b/src/api/main.cpp index 78d02861..3874ae1d 100644 --- a/src/api/main.cpp +++ b/src/api/main.cpp @@ -671,8 +671,9 @@ void defaultGet( shared_ptr< HttpServer::Response > response, shared_ptr< HttpSe print_request_info( request ); try { - auto web_root_path = fs::canonical( "web" ); - auto path = fs::canonical( web_root_path / request->path ); + auto web_root_path = fs::current_path() / "web"; + auto path = web_root_path / request->path; + //Check if path is within web_root_path if( distance( web_root_path.begin(), web_root_path.end() ) > distance( path.begin(), path.end() ) || !std::equal( web_root_path.begin(), web_root_path.end(), path.begin() ) ) diff --git a/src/api/server_http.hpp b/src/api/server_http.hpp index 8a6d2226..8ceb5810 100644 --- a/src/api/server_http.hpp +++ b/src/api/server_http.hpp @@ -306,6 +306,12 @@ namespace SimpleWeb { request->method=line.substr(0, method_end); request->path=line.substr(method_end+1, path_end-method_end-1); + // strip first / from path if it exists + if( request->path[ 0 ] == '/' ) + { + request->path = request->path.substr( 1 ); + } + size_t protocol_end; if((protocol_end=line.find('/', path_end+1))!=std::string::npos) { if(line.compare(path_end+1, protocol_end-path_end-1, "HTTP")!=0)