Protect against evil email address ".."

modules/base/tool.go

@@ -211,7 +211,7 @@ func SizedAvatarLink(email string, size int) string {
 // which includes app sub-url as prefix. However, it is possible
 // to return full URL if user enables Gravatar-like service.
 func AvatarLink(email string) string {
- return setting.AppSubURL + "/avatar/" + url.PathEscape(email)
+ return setting.AppSubURL + "/avatar/email-" + url.PathEscape(email)
 }
 
 // FileSize calculates the file size and generate user-friendly string.

routers/routes/routes.go

@@ -417,7 +417,7 @@ func RegisterRoutes(m *macaron.Macaron) {
  })
  // ***** END: User *****
 
- m.Get("/avatar/:email", user.AvatarByEmail)
+ m.Get("/avatar/email-:email", user.AvatarByEmail)
 
  adminReq := context.Toggle(&context.ToggleOptions{SignInRequired: true, AdminRequired: true})
 

routers/user/avatar.go

@@ -5,6 +5,7 @@
 package user
 
 import (
+ "errors"
  "strconv"
  "strings"
 
@@ -46,7 +47,10 @@ func Avatar(ctx *context.Context) {
 // AvatarByEmail redirects the browser to the appropriate Avatar link
 func AvatarByEmail(ctx *context.Context) {
  email := ctx.Params(":email")
-
+ if email == "" {
+ ctx.ServerError("invalid email address", errors.New("email cannot be empty"))
+ return
+ }
  size := ctx.QueryInt("size")
  if size == 0 {
  size = base.DefaultAvatarSize