[otrs-cvs] Support/Kernel/System Support.pm,1.53,1.53.2.1
"CVS commits notifications of OTRS.org" <[email protected]>
| Newsgroups | gmane.comp.otrs.cvs |
|---|---|
| Message-ID | <[email protected]> |
Comments:
Update of /home/cvs/Support/Kernel/System
In directory lancelot:/tmp/cvs-serv21618/Kernel/System
Modified Files:
Tag: rel-1_3
Support.pm
Log Message:
Added some security checks to archive checksum checks to make sure the script stays in the OTRS directory and ignores non-regular files.
Author: mg
Index: Support.pm
===================================================================
RCS file: /home/cvs/Support/Kernel/System/Support.pm,v
retrieving revision 1.53
retrieving revision 1.53.2.1
diff -2 -u -d -r1.53 -r1.53.2.1
--- Support.pm 4 Sep 2012 04:13:42 -0000 1.53
+++ Support.pm 13 Dec 2012 12:54:29 -0000 1.53.2.1
@@ -353,4 +353,6 @@
my ( $Self, %Param ) = @_;
+ my $Home = $Self->{ConfigObject}->Get('Home');
+
my @List = glob("$Param{In}/*");
FILE:
@@ -360,5 +362,8 @@
$File =~ s/\/\//\//g;
- # ignote cvs directories
+ # always stay in OTRS directory
+ next FILE if $File !~ /^\Q$Home\E/;
+
+ # ignore cvs directories
next FILE if $File =~ /Entries|Repository|Root|CVS|ARCHIVE/;
@@ -371,8 +376,9 @@
);
next FILE;
-
- # print "Directory: $File\n";
}
+ # ignore all non-regular files as links, pipes, sockets etc.
+ next FILE if ( !-f $File );
+
# if it's a file
my $OrigFile = $File;
---------------------------------------------------------------------
OTRS mailing list: cvs-log - Webpage: http://otrs.org/
Archive: http://lists.otrs.org/pipermail/cvs-log
To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/cvs-log