Protect against evil email address ".."

modules/base/tool.go

@@ -211,7 +211,7 @@ func SizedAvatarLink(email string, size int) string {
 // which includes app sub-url as prefix. However, it is possible
 // to return full URL if user enables Gravatar-like service.
 func AvatarLink(email string) string {
-	return setting.AppSubURL + "/avatar/" + url.PathEscape(email)
+	return setting.AppSubURL + "/avatar/email-" + url.PathEscape(email)
 }
 
 // FileSize calculates the file size and generate user-friendly string.

routers/routes/routes.go

@@ -417,7 +417,7 @@ func RegisterRoutes(m *macaron.Macaron) {
 	})
 	// ***** END: User *****
 
-	m.Get("/avatar/:email", user.AvatarByEmail)
+	m.Get("/avatar/email-:email", user.AvatarByEmail)
 
 	adminReq := context.Toggle(&context.ToggleOptions{SignInRequired: true, AdminRequired: true})
 

routers/user/avatar.go

@@ -5,6 +5,7 @@
 package user
 
 import (
+	"errors"
 	"strconv"
 	"strings"
 
@@ -46,7 +47,10 @@ func Avatar(ctx *context.Context) {
 // AvatarByEmail redirects the browser to the appropriate Avatar link
 func AvatarByEmail(ctx *context.Context) {
 	email := ctx.Params(":email")
-
+	if email == "" {
+		ctx.ServerError("invalid email address", errors.New("email cannot be empty"))
+		return
+	}
 	size := ctx.QueryInt("size")
 	if size == 0 {
 		size = base.DefaultAvatarSize