Extra bad path

2026-01-22 15:59:07 +00:00 · 2026-01-22 15:59:07 +00:00 · 477ca609a8
parent cd583deadb
commit 477ca609a8
1 changed files with 1 additions and 1 deletions
--- a/utils.py
+++ b/utils.py
@ -3969,7 +3969,7 @@ def check_bad_path(path: str):

    bad_strings = ('..', '/.', '%2e%2e', '%252e%252e',
                   '/sftp.', '/sftp-', '/statistics',
-                   '/config/', 'settings.')
+                   '/config/', 'settings.', 'credentials')

    # allow /.well-known/...
    if '/.' in path_lower: