Skip to content

Commit 17635df

Browse files
committed
use prefix for directory
1 parent c8b0659 commit 17635df

File tree

1 file changed

+8
-5
lines changed

1 file changed

+8
-5
lines changed

code/go/0chain.net/blobbercore/handler/authticket.go

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,7 @@ package handler
33
import (
44
"context"
55
"encoding/json"
6-
"fmt"
7-
"regexp"
6+
"strings"
87

98
"github.com/0chain/blobber/code/go/0chain.net/blobbercore/allocation"
109
"github.com/0chain/blobber/code/go/0chain.net/blobbercore/readmarker"
@@ -28,14 +27,18 @@ func verifyAuthTicket(ctx context.Context, authTokenString string, allocationObj
2827
}
2928

3029
if refRequested.LookupHash != authToken.FilePathHash {
31-
authTokenRef, err := reference.GetLimitedRefFieldsByLookupHashWith(ctx, authToken.AllocationID, authToken.FilePathHash, []string{"id", "path"})
30+
authTokenRef, err := reference.GetLimitedRefFieldsByLookupHashWith(ctx, authToken.AllocationID, authToken.FilePathHash, []string{"id", "path", "type"})
3231
if err != nil {
3332
return nil, err
3433
}
35-
36-
if matched, _ := regexp.MatchString(fmt.Sprintf("^%v", authTokenRef.Path), refRequested.Path); !matched {
34+
if authTokenRef.Type == reference.FILE {
35+
return nil, common.NewError("invalid_parameters", "Auth ticket is not valid for the resource being requested")
36+
}
37+
prefixPath := authTokenRef.Path + "/"
38+
if !strings.HasPrefix(refRequested.Path, prefixPath) {
3739
return nil, common.NewError("invalid_parameters", "Auth ticket is not valid for the resource being requested")
3840
}
41+
3942
}
4043
if verifyShare {
4144
shareInfo, err := reference.GetShareInfo(ctx, authToken.ClientID, authToken.FilePathHash)

0 commit comments

Comments
 (0)