From be902be453cfeb0a7ea7ebc12f9459f38755f16e Mon Sep 17 00:00:00 2001
From: ttys3 <41882455+ttys3@users.noreply.github.com>
Date: Fri, 5 Jul 2019 19:15:57 +0800
Subject: [PATCH] fix: prevent maliciously constructed parameters like
 `/api/public/dl/XZzCDnK2_not_exists_hash_name` cause panic (#791)

---
 http/public.go | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/http/public.go b/http/public.go
index ab44778c..ba2692b3 100644
--- a/http/public.go
+++ b/http/public.go
@@ -40,8 +40,15 @@ var withHashFile = func(fn handleFunc) handleFunc {
 	}
 }
 
+// ref to https://github.com/filebrowser/filebrowser/pull/727
+// `/api/public/dl/MEEuZK-v/file-name.txt` for old browsers to save file with correct name
 func ifPathWithName(r *http.Request) string {
 	pathElements := strings.Split(r.URL.Path, "/")
+	// prevent maliciously constructed parameters like `/api/public/dl/XZzCDnK2_not_exists_hash_name`
+	// len(pathElements) will be 1, and golang will panic `runtime error: index out of range`
+	if len(pathElements) < 2 {
+		return r.URL.Path
+	}
 	id := pathElements[len(pathElements)-2]
 	return id
 }