fix: Security Patches (#6743)

mealie/routes/recipe/bulk_actions.py

@@ -2,6 +2,7 @@ from functools import cached_property
 from pathlib import Path
 
 from fastapi import APIRouter, HTTPException
+from pydantic import UUID4
 
 from mealie.core.dependencies.dependencies import get_temporary_zip_path
 from mealie.core.security import create_file_token
@@ -48,14 +49,15 @@ class RecipeBulkActionsController(BaseUserController):
         with get_temporary_zip_path() as temp_path:
             self.service.export_recipes(temp_path, export_recipes.recipes)
 
-    @router.get("/export/download")
-    def get_exported_data_token(self, path: Path):
+    @router.get("/export/{export_id}/download")
+    def get_exported_data_token(self, export_id: UUID4):
         """Returns a token to download a file"""
-        path = Path(path).resolve()
 
-        if not path.is_relative_to(self.folders.DATA_DIR):
-            raise HTTPException(400, "path must be relative to data directory")
+        export = self.service.get_export(export_id)
+        if not export:
+            raise HTTPException(404, "export not found")
 
+        path = Path(export.path).resolve()
         return {"fileToken": create_file_token(path)}
 
     @router.get("/export", response_model=list[GroupDataExport])

mealie/routes/utility_routes.py

@@ -17,8 +17,12 @@ async def download_file(file_path: Path = Depends(validate_file_token)):
     file_path = Path(file_path).resolve()
 
     dirs = get_app_dirs()
+    allowed_dirs = [
+        dirs.BACKUP_DIR,  # admin backups
+        dirs.GROUPS_DIR,  # group exports
+    ]
 
-    if not file_path.is_relative_to(dirs.DATA_DIR):
+    if not any(file_path.is_relative_to(allowed_dir) for allowed_dir in allowed_dirs):
         raise HTTPException(status.HTTP_400_BAD_REQUEST)
 
     if not file_path.is_file():

mealie/services/recipe/recipe_bulk_service.py

@@ -1,11 +1,14 @@
 from pathlib import Path
 
+from pydantic import UUID4
+
 from mealie.core.exceptions import UnexpectedNone
 from mealie.repos.repository_factory import AllRepositories
 from mealie.schema.group.group_exports import GroupDataExport
 from mealie.schema.recipe import CategoryBase
 from mealie.schema.recipe.recipe_category import TagBase
 from mealie.schema.recipe.recipe_settings import RecipeSettings
+from mealie.schema.response.pagination import PaginationQuery
 from mealie.schema.user.user import GroupInDB, PrivateUser
 from mealie.services._base_service import BaseService
 from mealie.services.exporter import Exporter, RecipeExporter
@@ -25,7 +28,11 @@ class RecipeBulkActionsService(BaseService):
         exporter.run(self.repos)
 
     def get_exports(self) -> list[GroupDataExport]:
-        return self.repos.group_exports.multi_query({"group_id": self.group.id})
+        exports_page = self.repos.group_exports.page_all(PaginationQuery(per_page=-1))
+        return exports_page.items
+
+    def get_export(self, id: UUID4) -> GroupDataExport | None:
+        return self.repos.group_exports.get_one(id)
 
     def purge_exports(self) -> int:
         all_exports = self.get_exports()