git.samba.org / gd / samba-autobuild / .git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 8bf0f35)
minor wsmbconf and cgi changes
authorAndrew Tridgell <tridge@samba.org>
Sun, 23 Nov 1997 02:42:22 +0000 (02:42 +0000)
committerAndrew Tridgell <tridge@samba.org>
Sun, 23 Nov 1997 02:42:22 +0000 (02:42 +0000)
(This used to be commit bca9c49e6f24c2ee79cbb9b6ebf69d6647146fc1)

source3/cgi.c patch | blob | history
source3/web/cgi.c patch | blob | history
source3/wsmbconf.c patch | blob | history

diff --git a/source3/cgi.c b/source3/cgi.c
index 3739d712d3981d82712000b6bdeaf713491ddee7..f165c56110b5e259c71ed0b7fafbf4a50973cc72 100644 (file)
--- a/source3/cgi.c
+++ b/source3/cgi.c
@@ -501,9 +501,22 @@ static void cgi_download(char *file)
 {
        struct stat st;
        char buf[1024];
-       int fd, l;
+       int fd, l, i;
        char *p;
 
+       /* sanitise the filename */
+       for (i=0;file[i];i++) {
+               if (!isalnum(file[i]) && !strchr("/.-_", file[i])) {
+                       cgi_setup_error("404 File Not Found","",
+                                       "Illegal character in filename");
+               }
+       }
+
+       if (strstr(file,"..")) {
+               cgi_setup_error("404 File Not Found","",
+                               "Relative paths not allowed");
+       }
+
        if (!file_exist(file, &st)) {
                cgi_setup_error("404 File Not Found","",
                                "The requested file was not found");
@@ -574,7 +587,7 @@ void cgi_setup(char *rootdir)
 
        if (!authenticated) {
                cgi_setup_error("401 Authorization Required", 
-                               "WWW-Authenticate: Basic realm=\"samba\"\r\n",
+                               "WWW-Authenticate: Basic realm=\"root\"\r\n",
                                "You must be authenticated to use this service");
        }
 
@@ -604,3 +617,5 @@ void cgi_setup(char *rootdir)
        printf("HTTP/1.1 200 OK\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n");
        
 }
+
+
diff --git a/source3/web/cgi.c b/source3/web/cgi.c
index 3739d712d3981d82712000b6bdeaf713491ddee7..f165c56110b5e259c71ed0b7fafbf4a50973cc72 100644 (file)
--- a/source3/web/cgi.c
+++ b/source3/web/cgi.c
@@ -501,9 +501,22 @@ static void cgi_download(char *file)
 {
        struct stat st;
        char buf[1024];
-       int fd, l;
+       int fd, l, i;
        char *p;
 
+       /* sanitise the filename */
+       for (i=0;file[i];i++) {
+               if (!isalnum(file[i]) && !strchr("/.-_", file[i])) {
+                       cgi_setup_error("404 File Not Found","",
+                                       "Illegal character in filename");
+               }
+       }
+
+       if (strstr(file,"..")) {
+               cgi_setup_error("404 File Not Found","",
+                               "Relative paths not allowed");
+       }
+
        if (!file_exist(file, &st)) {
                cgi_setup_error("404 File Not Found","",
                                "The requested file was not found");
@@ -574,7 +587,7 @@ void cgi_setup(char *rootdir)
 
        if (!authenticated) {
                cgi_setup_error("401 Authorization Required", 
-                               "WWW-Authenticate: Basic realm=\"samba\"\r\n",
+                               "WWW-Authenticate: Basic realm=\"root\"\r\n",
                                "You must be authenticated to use this service");
        }
 
@@ -604,3 +617,5 @@ void cgi_setup(char *rootdir)
        printf("HTTP/1.1 200 OK\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n");
        
 }
+
+
diff --git a/source3/wsmbconf.c b/source3/wsmbconf.c
index 203952c204f79166080190be0e3605cb3d28c973..8abdd6d3985a779ee0eed53f92d2747a0c6411e4 100644 (file)
--- a/source3/wsmbconf.c
+++ b/source3/wsmbconf.c
@@ -31,11 +31,12 @@
 #define GLOBALS_SNUM -2
 #define DEFAULTS_SNUM -1
 
+static pstring servicesf = CONFIGFILE;
+
 
 /* start the page with standard stuff */
 static void print_header(void)
 {
-       printf("Content-type: text/html\n\n");
        printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2//EN\">\n");
        printf("<HTML>\n<HEAD>\n<TITLE>smb.conf</TITLE>\n</HEAD>\n<BODY>\n\n");
 }
@@ -47,15 +48,6 @@ static void print_footer(void)
        printf("\n</BODY>\n</HTML>\n");
 }
 
-/* setup persisant variables */
-static void set_persistent(char *name)
-{
-       char *p;
-       p = cgi_variable(name);
-       if (!p) return;
-       printf("<input type=hidden name=%s value=%s>\n", name, p);
-}
-
 /* display a servce, ready for editing */
 static void show_service(int snum, int allparameters)
 {
@@ -119,29 +111,11 @@ static void show_services(void)
 }
 
 
-/* load the smb.conf file into loadparm. this also does the chroot
-   to the config directory. This must be called _BEFORE_ any client
-   supplied data is parsed */
+/* load the smb.conf file into loadparm. */
 static int load_config(void)
 {
-       static pstring servicesf = CONFIGFILE;
-       char *p;
-
-       p = strrchr(servicesf,'/');
-       if (!p) return 0;
-
-       *p = 0;
-
        setuid(0);
-
-       if (chdir(servicesf) || chroot(servicesf)) {
-               printf("wsmbconf is not configured correctly\n");
-               return 0;
-       }
-
-       *p = '/';
-
-       if (!lp_load(p,False)) {
+       if (!lp_load(servicesf,False)) {
                printf("<b>Can't load %s - using defaults</b><p>\n", 
                       servicesf);
        }
@@ -151,14 +125,9 @@ static int load_config(void)
 
 static int save_reload(void)
 {
-       static pstring servicesf = CONFIGFILE;
-       char *p;
        FILE *f;
 
-       p = strrchr(servicesf,'/');
-       if (!p) return 0;
-
-       f = fopen(p,"w");
+       f = fopen(servicesf,"w");
        if (!f) {
                printf("failed to open %s for writing\n", servicesf);
                return 0;
@@ -172,7 +141,7 @@ static int save_reload(void)
 
        lp_killunused(NULL);
 
-       if (!lp_load(p,False)) {
+       if (!lp_load(servicesf,False)) {
                 printf("Can't reload %s\n", servicesf);
                 return 0;
         }
@@ -233,16 +202,33 @@ static void process_requests(void)
 
 int main(int argc, char *argv[])
 {
+       extern char *optarg;
+       extern int optind;
        extern FILE *dbf;
+       int opt;
+
+       dbf = fopen("/dev/null", "w");
+
+       if (!dbf) dbf = stderr;
+
+       cgi_setup(WEB_ROOT);
 
-       print_header();
 
-       dbf = stderr;
+       while ((opt = getopt(argc, argv,"s:")) != EOF) {
+               switch (opt) {
+               case 's':
+                       pstrcpy(servicesf,optarg);
+                       break;    
+               }
+       }
+
+
+       print_header();
 
        charset_initialise();
 
        if (load_config()) {
-               cgi_load_variables();
+               cgi_load_variables(NULL);
                process_requests();
                show_services();
        }
Unnamed repository; edit this file 'description' to name the repository.