From 03fbb1e68ebb2dcc953826ed4542326e20fdf758 Mon Sep 17 00:00:00 2001 From: Unrud Date: Sun, 4 Sep 2016 13:35:44 +0200 Subject: [PATCH] Don't strip {} in get method If someone uploads a file that starts or ends with the chars {}, all REPORT requests on that collection will fail and it's impossible to delete the file. --- radicale/storage.py | 1 - 1 file changed, 1 deletion(-) diff --git a/radicale/storage.py b/radicale/storage.py index 867b5626..af2fe38b 100644 --- a/radicale/storage.py +++ b/radicale/storage.py @@ -618,7 +618,6 @@ class Collection(BaseCollection): def get(self, href): if not href: return None - href = href.strip("{}") if not is_safe_filesystem_path_component(href): self.logger.debug( "Can't translate name safely to filesystem: %s", href)