fix(ui): 修复图片路径与缩略显示；审核页展示图+介绍+用户

app/blueprints/main.py

@@ -1,4 +1,5 @@
-from flask import Blueprint, redirect, url_for, current_app, send_from_directory
+import os
+from flask import Blueprint, redirect, url_for, current_app, send_file, abort
 
 bp = Blueprint("main", __name__)
 
@@ -8,4 +9,10 @@ def index():
 
 @bp.route("/uploads/<path:filename>")
 def uploads(filename):
-    return send_from_directory(current_app.config["UPLOAD_FOLDER"], filename)
+    root = os.path.abspath(current_app.config["UPLOAD_FOLDER"])
+    path = filename
+    if not os.path.isabs(path):
+        path = os.path.abspath(os.path.join(root, filename))
+    if not path.startswith(root):
+        abort(404)
+    return send_file(path)