[otrs-cvs] otrs/bin otrs.CheckSum.pl,1.9,1.9.4.1

Comments:
Update of /home/cvs/otrs/bin
In directory lancelot:/tmp/cvs-serv8545/bin

Modified Files:
      Tag: rel-3_1
	otrs.CheckSum.pl 
Log Message:
Added some security checks to otrs.CheckSum.pl to make sure the script stays in the OTRS directory and ignores non-regular files.

Author: mg

Index: otrs.CheckSum.pl
===================================================================
RCS file: /home/cvs/otrs/bin/otrs.CheckSum.pl,v
retrieving revision 1.9
retrieving revision 1.9.4.1
diff -2 -u -d -r1.9 -r1.9.4.1
--- otrs.CheckSum.pl	28 Oct 2010 11:13:28 -0000	1.9
+++ otrs.CheckSum.pl	11 Dec 2012 16:25:49 -0000	1.9.4.1
@@ -2,5 +2,5 @@
 # --
 # bin/otrs.CheckSum.pl - a tool to compare changes in a installation
-# Copyright (C) 2001-2010 OTRS AG, http://otrs.org/
+# Copyright (C) 2001-2012 OTRS AG, http://otrs.org/
 # --
 # $Id$
@@ -36,5 +36,6 @@
 use Digest::MD5 qw(md5_hex);
 
-my $Start   = $RealBin . '/../';
+my $Start = $RealBin;
+$Start =~ s{/bin}{/}smx;
 my $Archive = '';
 my $Action  = 'compare';
@@ -46,5 +47,5 @@
 if ( exists $Opts{h} || !keys %Opts ) {
     print "otrs.CheckSum.pl <Revision $VERSION> - OTRS check sum\n";
-    print "Copyright (C) 2001-2010 OTRS AG, http://otrs.org/\n";
+    print "Copyright (C) 2001-2012 OTRS AG, http://otrs.org/\n";
     print
         "usage: otrs.CheckSum.pl -a create|compare [-b /path/to/ARCHIVE] [-d /path/to/framework]\n";
@@ -100,4 +101,7 @@
         $File =~ s/\/\//\//g;
 
+        # always stay in OTRS directory
+        next FILE if $File !~ /^\Q$Start\E/;
+
         # ignote cvs directories
         next if $File =~ /Entries|Repository|Root|CVS|ARCHIVE/;
@@ -111,4 +115,7 @@
         }
 
+        # ignore all non-regular files as links, pipes, sockets etc.
+        next FILE if ( !-f $File );
+
         # if it's a file
         my $OrigFile = $File;
---------------------------------------------------------------------
OTRS mailing list: cvs-log - Webpage: http://otrs.org/
Archive: http://lists.otrs.org/pipermail/cvs-log
To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/cvs-log