diff --git a/fileserver/fileserver.py b/fileserver/fileserver.py index dba9d19..c6695b8 100644 --- a/fileserver/fileserver.py +++ b/fileserver/fileserver.py @@ -59,16 +59,16 @@ def download(path): @app.route("/", methods=["DELETE"]) def delete(path): - path = Path( + real_path = Path( safe_join( fspath(app.config["UPLOAD_FOLDER"]), fspath(path) ) ) - if not path.exists() or not path.is_file(): + if not real_path.exists() or not real_path.is_file(): abort(Response(f"File {str(path)} not found", 404)) - path.unlink() + real_path.unlink() return json.dumps(str(path)), 200