thelis fix

git-svn-id: https://svn.berlios.de/svnroot/repos/yacy/trunk@1364 6c8d7289-2bf4-0310-a012-ef5d649a1542

htroot/yacy/transfer.java

@@ -128,6 +128,7 @@ public final class transfer {
                     path.mkdirs();
                     File file = new File(path, filename);
                     try {
+                        if (file.getCanonicalPath().toString().startsWith(path.getCanonicalPath().toString())){
                             serverFileUtils.write(filebytes, file);
                             String md5t = serverCodings.encodeMD5Hex(file);
                             if (md5t.equals(md5)) {
@@ -137,6 +138,11 @@ public final class transfer {
                                 prop.put("response", "transfer failure");
                                 sb.getLog().logFine("RankingTransmission: transfer failunre from peer " + otherpeerName + " for CR file " + filename);
                             }
+                        }else{
+                            //exploit?
+                            prop.put("response", "io error");
+                            return prop;
+                        }
                     } catch (IOException e) {
                         prop.put("response", "io error");
                     }