Majestic's http allows downloading files from fs-root ("/")

[lyukshinra]

• fw_version: 2.5.01.13
• mj_version: master+b8ae1de, 2025-01-05
• installation method: sysupgrade rootfs
• modified majestic.yaml: yes

Issue description

For authenticated users Majestic's built-in http-server allows to download any files from any path of filesystem if file not found in http root directory. It looks like Majestic trying to search such files from fs-root ("/"). So http-root not limited to /var/www/. This probably is security issue.

Expectations

If url points to file, not existing in http-root directory (/var/www/), http server must return 404 error. Of cource exept special url-paths, like statistics.

Steps to reproduce

Try to http-get any file, that not exists in /var/www/ by it absolute path.
http://[camera_ip]/etc/passwd
http://[camera_ip]/etc/shadow