Don't send hidden files in /f/

1 files changed, 5 insertions, 1 deletions

diff --git a/webserver.js b/webserver.js
index e5a62c8..5496f11 100755
--- a/webserver.js
+++ b/webserver.js
@@ -84,6 +84,10 @@ for (let i = 0; i < module_list.length; i++) {
 }
 
 
+function anyComponentHidden(fname) {
+	return fname[0] == "." || fname.indexOf("/.") != -1;
+}
+
 // if 'mime' is not null/undefined, it should be the content-type of the file
 // options:
 //   { mime: "content-type value", listdirs: true/false, cors: true/false }
@@ -92,7 +96,7 @@ function requestFile(req, res, path, origpath, options) {
 	if (options == null) options = {};
 	fname = cmn.webfilesdir + path;
 	console.log("Requesting file " + fname);
-	if (!fs.existsSync(fname)) {
+	if (anyComponentHidden(fname) || !fs.existsSync(fname)) {
 		res.status(404).send("That file does not exist.");
 		return;
 	}