[otrs-cvs] otrs/bin otrs.CheckSum.pl,1.14,1.15

Comments:
Update of /home/cvs/otrs/bin
In directory lancelot:/tmp/cvs-serv8563/bin

Modified Files:
	otrs.CheckSum.pl 
Log Message:
Added some security checks to otrs.CheckSum.pl to make sure the script stays in the OTRS directory and ignores non-regular files.

Author: mg

Index: otrs.CheckSum.pl
===================================================================
RCS file: /home/cvs/otrs/bin/otrs.CheckSum.pl,v
retrieving revision 1.14
retrieving revision 1.15
diff -2 -u -d -r1.14 -r1.15
--- otrs.CheckSum.pl	20 Nov 2012 16:03:06 -0000	1.14
+++ otrs.CheckSum.pl	11 Dec 2012 16:25:56 -0000	1.15
@@ -37,5 +37,6 @@
 use Digest::MD5 qw(md5_hex);
 
-my $Start   = $RealBin . '/../';
+my $Start = $RealBin;
+$Start =~ s{/bin}{/}smx;
 my $Archive = '';
 my $Action  = 'compare';
@@ -101,4 +102,7 @@
         $File =~ s/\/\//\//g;
 
+        # always stay in OTRS directory
+        next FILE if $File !~ /^\Q$Start\E/;
+
         # ignote cvs directories
         next if $File =~ /Entries|Repository|Root|CVS|ARCHIVE/;
@@ -112,4 +116,7 @@
         }
 
+        # ignore all non-regular files as links, pipes, sockets etc.
+        next FILE if ( !-f $File );
+
         # if it's a file
         my $OrigFile = $File;
---------------------------------------------------------------------
OTRS mailing list: cvs-log - Webpage: http://otrs.org/
Archive: http://lists.otrs.org/pipermail/cvs-log
To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/cvs-log