Fix paths provided in image filename (#147)

michael-j-green · web-flow · commit f344c6cfdc0b · 2025-05-09T21:26:34.000+10:00
diff --git a/hasheous/Controllers/V1.0/MetadataProxyController.cs b/hasheous/Controllers/V1.0/MetadataProxyController.cs
@@ -1465,10 +1465,14 @@ public async Task<IActionResult> GetImage(string ImageId)
         public IActionResult GetTheGamesDBImage(MetadataQuery.imageSize ImageSize, string FileName)
         {
             FileName = System.Uri.UnescapeDataString(FileName);
-            if (FileName.Contains("..") || FileName.Contains("/") || FileName.Contains("\\"))
+            if (FileName.Contains("..") || FileName.Contains("\\"))
             {
                 return BadRequest("Invalid image ID");
             }
+            else if (FileName.Contains("/"))
+            {
+                // forward slashes are allowed in the file name
+            }
             string imageFile = Path.Combine(Config.LibraryConfiguration.LibraryMetadataDirectory_TheGamesDb, "Images", ImageSize.ToString(), FileName);
             string imagePath = Path.GetDirectoryName(imageFile);
 

Original file line number	Diff line number	Diff line change
`@@ -1465,10 +1465,14 @@ public async Task<IActionResult> GetImage(string ImageId)`
`1465`	`1465`	`public IActionResult GetTheGamesDBImage(MetadataQuery.imageSize ImageSize, string FileName)`
`1466`	`1466`	`{`
`1467`	`1467`	`FileName = System.Uri.UnescapeDataString(FileName);`
`1468`		`- if (FileName.Contains("..") \|\| FileName.Contains("/") \|\| FileName.Contains("\\"))`
	`1468`	`+ if (FileName.Contains("..") \|\| FileName.Contains("\\"))`
`1469`	`1469`	`{`
`1470`	`1470`	`return BadRequest("Invalid image ID");`
`1471`	`1471`	`}`
	`1472`	`+ else if (FileName.Contains("/"))`
	`1473`	`+ {`
	`1474`	`+ // forward slashes are allowed in the file name`
	`1475`	`+ }`
`1472`	`1476`	`string imageFile = Path.Combine(Config.LibraryConfiguration.LibraryMetadataDirectory_TheGamesDb, "Images", ImageSize.ToString(), FileName);`
`1473`	`1477`	`string imagePath = Path.GetDirectoryName(imageFile);`
`1474`	`1478`