affected/package: http

[motaz]

What is the URL of the page with the issue?

What is your user agent?

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0

Screenshot

What did you do?

Uploading multi-part form: when uploading directory, directory name does not appear in uploaded file name, for example: templates/index.html will receive uploaded file as index.html

What did you expect to see?

Receiving directory name with file name: templates/index.html

What did you see instead?

index.html

this issue has started on version 1.17, Go version 1.16.5 were working fine

[seankhliao]

please show code and steps to reproduce the issue

[motaz]

After running below code, select directory to upload, in version 1.16 you will send directory name with files, but in 1.17 only file names will be get:

folderbug.zip

[seankhliao]

This is an intentional security fix #45789

Closing as working as intended

[motaz]

I was relying on this feature to upload templates, and static folders for Go Web applications in my GoCat project
https://github.com/motaz/gocat
Now I should to remove uploading directory section :(

[seankhliao]

as mentioned in the linked issue, the full path is still available via the file headers

[motaz]

Yes I found it in Content-Disposition header, thanks
Full path from client PC is not required, only selected directory, for that reason I didn't understand where is the security issue here