diff --git a/pkg/api/plugins.go b/pkg/api/plugins.go index 44be12aecd9..9157fc9a1cf 100644 --- a/pkg/api/plugins.go +++ b/pkg/api/plugins.go @@ -265,11 +265,12 @@ func (hs *HTTPServer) GetPluginAssets(c *models.ReqContext) { return } + // prepend slash for cleaning relative paths requestedFile := filepath.Clean(filepath.Join("/", c.Params("*"))) rel, err := filepath.Rel("/", requestedFile) if err != nil { - // this should not never fail - c.Handle(hs.Cfg, 500, "Relative path found", err) + // slash is prepended above therefore this is not expected to fail + c.Handle(hs.Cfg, 500, "Failed to get the relative path", err) return }