maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

correctly validate if a symlink is within the customers home-directory if it's not an absolute path; fixes #1242

Browse Source 
Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
This commit is contained in:
Michael Kaufmann
2024-03-08 09:23:21 +01:00
parent bcf588a2e4
commit ce509273d4
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
lib/Froxlor/FileDir.php
View File

@@ -140,6 +140,12 @@ class FileDir
if (is_link($check_dir)) {
$original_target = $check_dir;
$check_dir = readlink($check_dir);
$link_dir = dirname($original_target);
// check whether the link is relative or absolute
if (substr($check_dir, 0, 1) != '/') {
// relative directory, prepend link_dir
$check_dir = $link_dir . '/' . $check_dir;
}
if (substr($check_dir, 0, strlen($fixed_homedir)) != $fixed_homedir) {
throw new Exception("Found symlink pointing outside of customer home directory: " . substr($original_target, strlen($fixed_homedir)));
}