Merge branch 'bugfix/import-cleanup' into 'dev'

Fix import dir cleanup

See merge request crafty-controller/crafty-4!918

CHANGELOG.md

@@ -6,6 +6,7 @@ TBD
 - Change hour and minute intervals in APScheudler to fix incorrect triggers ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/910))
 - Use asyncio locks to limit upload handler race condition ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/907))
 - Fix static fonts not working on some browsers ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/906))
+- Fix import directory cleanup was not pointing to the proper directory ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/918))
 ### Tweaks
 TBD
 ### Lang

app/classes/shared/tasks.py

@@ -5,6 +5,7 @@ import threading
 import asyncio
 import datetime
 import json
+from pathlib import Path
 from zoneinfo import ZoneInfoNotFoundError
 from tzlocal import get_localzone
 from apscheduler.events import EVENT_JOB_EXECUTED
@@ -815,15 +816,16 @@ class TasksManager:
                     os.remove(os.path.join(file))
                 except FileNotFoundError:
                     logger.debug("Could not clear out file from temp directory")
-
-        for file in os.listdir(
-            os.path.join(self.controller.project_root, "import", "upload")
-        ):
-            if self.helper.is_file_older_than_x_days(
-                os.path.join(self.controller.project_root, "import", "upload", file)
-            ):
+        import_path = Path(self.controller.project_root, "import", "upload")
+        for file in os.listdir(import_path):
+            file_path = Path(import_path, file).resolve(strict=True)
+            if not self.helper.validate_traversal(import_path, file_path):
+                logger.error(
+                    "Traversal detected while deleting import file %s", file_path
+                )
+            if self.helper.is_file_older_than_x_days(file_path):
                 try:
-                    os.remove(os.path.join(file))
+                    os.remove(file_path)
                 except FileNotFoundError:
                     logger.debug("Could not clear out file from import directory")