net-ftp/glftpd/files/glftpd-2.00-script-path-checks.patch


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

Make people don't try scanning for files they shouldn't have 
access to normally.

http://bugs.gentoo.org/show_bug.cgi?id=82544

--- bin/sitenfo.sh
+++ bin/sitenfo.sh
@@ -37,6 +37,11 @@
     exit 0
 }
 
+[ "${1/..\/}" != "$1" ] && {
+	echo "That zipfile does not exist!"
+	exit 1
+}
+
 [ ! -e "$1" ] && {
     echo "That zipfile does not exist!"
     exit 1
--- bin/sitezipchk.sh
+++ bin/sitezipchk.sh
@@ -37,6 +37,11 @@
     exit 0
 }
 
+[ "${1/..\/}" != "$1" ] && {
+	echo "That zipfile does not exist!"
+	exit 1
+}
+
 [ ! -e "$1" ] && {
     echo "That zipfile does not exist!"
     exit 1
--- bin/siteziplist.sh
+++ bin/siteziplist.sh
@@ -37,6 +37,11 @@
     exit 0
 }
 
+[ "${1/..\/}" != "$1" ] && {
+	echo "That zipfile does not exist!"
+	exit 1
+}
+
 [ ! -e "$1" ] && {
     echo "That zipfile does not exist!"
     exit 1