mirrors/fdroidserver
1
0
Fork 0
mirror of https://github.com/f-droid/fdroidserver.git synced 2025-09-14 15:02:51 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

VercodeOperation: only allow simple math expresssions and %c

Browse source
This commit is contained in:
Hans-Christoph Steiner 2018-03-02 12:50:48 +01:00
parent 6876e28bb4
commit 8f30c892c5
4 changed files with 58 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
fdroidserver/checkupdates.py
View file

@ -429,6 +429,9 @@ def checkupdates_app(app):
msg = 'Invalid update check method'
if version and vercode and app.VercodeOperation:
if not common.VERCODE_OPERATION_RE.match(app.VercodeOperation):
raise MetaDataException(_('Invalid VercodeOperation: {field}')
.format(field=app.VercodeOperation))
oldvercode = str(int(vercode))
op = app.VercodeOperation.replace("%c", oldvercode)
vercode = str(eval(op))