
Fixes CSRF and directory traversal

From 41acade01ae88f7b7bbdba308a0886771aa582fd Mon Sep 17 00:00:00 2001
From: Kyle Neideck <kyle@bearisdriving.com>

From 318ab179865e0707d7945edc3a13a464a108d583 Mon Sep 17 00:00:00 2001
From: Calum Lind <calumlind+deluge@gmail.com>

--- deluge-1.3.10.orig/deluge/ui/web/json_api.py
+++ deluge-1.3.10/deluge/ui/web/json_api.py
@@ -252,6 +252,10 @@ class JSON(resource.Resource, component.
         Handler to take the json data as a string and pass it on to the
         _handle_request method for further processing.
         """
+        if request.getHeader('content-type') != 'application/json':
+            message = 'Invalid JSON request content-type: %s' % request.getHeader('content-type')
+            raise JSONException(message)
+
         log.debug("json-request: %s", request.json)
         response = {"result": None, "error": None, "id": None}
         response["id"], d, response["error"] = self._handle_request(request)
--- deluge-1.3.10.orig/deluge/ui/web/server.py
+++ deluge-1.3.10/deluge/ui/web/server.py
@@ -171,6 +171,10 @@ class Upload(resource.Resource):
         }), request)
 
 class Render(resource.Resource):
+    def __init__(self):
+        resource.Resource.__init__(self)
+        # Make a list of all the template files to check requests against.
+        self.template_files = fnmatch.filter(os.listdir(rpath('render')), '*.html')
 
     def getChild(self, path, request):
         request.render_file = path
@@ -181,6 +185,10 @@ class Render(resource.Resource):
             request.setResponseCode(http.INTERNAL_SERVER_ERROR)
             return ""
 
+        if request.render_file not in self.template_files:
+            request.setResponseCode(http.NOT_FOUND)
+            return "<h1>404 - Not Found</h1>"
+
         filename = os.path.join("render", request.render_file)
         template = Template(filename=rpath(filename))
         request.setHeader("content-type", "text/html")
