diff --git a/yacv_server/myhttp.py b/yacv_server/myhttp.py index 503320b..9cb9f10 100644 --- a/yacv_server/myhttp.py +++ b/yacv_server/myhttp.py @@ -42,8 +42,8 @@ class HTTPHandler(SimpleHTTPRequestHandler): path = super().translate_path(path) path = os.path.realpath(path) # Avoid symlink hacks if self.directory: # Ensure proper subdirectory - base = os.path.abspath(self.directory) - if not os.path.abspath(path).startswith(base): + base = os.path.realpath(self.directory) + if not path.startswith(base): self.send_error(HTTPStatus.FORBIDDEN, "Path is not in the frontend directory") return '' return path