From 8c7f235ee129be380c256df6f3ea96a37a9608bd Mon Sep 17 00:00:00 2001
From: Yang Luo <hsluoyz@qq.com>
Date: Sun, 17 Jul 2022 14:29:06 +0800
Subject: [PATCH] Fix bug in uploadFile()'s URL.

---
 authz/authz.go          | 1 +
 object/storage.go       | 1 +
 routers/authz_filter.go | 4 ++++
 3 files changed, 6 insertions(+)

diff --git a/authz/authz.go b/authz/authz.go
index 607a0c3c..b5898233 100644
--- a/authz/authz.go
+++ b/authz/authz.go
@@ -92,6 +92,7 @@ p, *, *, GET, /api/get-payment, *, *
 p, *, *, POST, /api/update-payment, *, *
 p, *, *, POST, /api/invoice-payment, *, *
 p, *, *, GET, /api/get-providers, *, *
+p, *, *, POST, /api/notify-payment, *, *
 p, *, *, POST, /api/unlink, *, *
 p, *, *, POST, /api/set-password, *, *
 p, *, *, POST, /api/send-verification-code, *, *
diff --git a/object/storage.go b/object/storage.go
index bac488f4..090d2916 100644
--- a/object/storage.go
+++ b/object/storage.go
@@ -55,6 +55,7 @@ func escapePath(path string) string {
 
 func getUploadFileUrl(provider *Provider, fullFilePath string, hasTimestamp bool) (string, string) {
 	escapedPath := escapePath(fullFilePath)
+	escapedPath = escapePath(escapedPath)
 	objectKey := util.UrlJoin(util.GetUrlPath(provider.Domain), escapedPath)
 
 	host := ""
diff --git a/routers/authz_filter.go b/routers/authz_filter.go
index 4070ae38..d3a7b416 100644
--- a/routers/authz_filter.go
+++ b/routers/authz_filter.go
@@ -122,6 +122,10 @@ func AuthzFilter(ctx *context.Context) {
 	urlPath := getUrlPath(ctx.Request.URL.Path)
 	objOwner, objName := getObject(ctx)
 
+	if strings.HasPrefix(urlPath, "/api/notify-payment") {
+		urlPath = "/api/notify-payment"
+	}
+
 	isAllowed := authz.IsAllowed(subOwner, subName, method, urlPath, objOwner, objName)
 
 	result := "deny"