CVS: tmda-cgi CgiUtil.py,1.22,1.23 ChangeLog,1.59,1.60 EditFilter.py,1.3,1.4 EditList.py,1.7,1.8 Session.py,1.36,1.37 Templates.py,1.3,1.4 defaults.ini,1.20,1.21
Gre7g Luterman <[email protected]>
| Newsgroups | gmane.mail.spam.tmda.cvs |
|---|---|
| Message-ID | <[email protected]> |
Update of /cvsroot/tmda/tmda-cgi
In directory sc8-pr-cvs1:/tmp/cvs-serv756
Modified Files:
CgiUtil.py ChangeLog EditFilter.py EditList.py Session.py
Templates.py defaults.ini
Log Message:
Made sure users can only edit/view files in approved directories.
Index: CgiUtil.py
===================================================================
RCS file: /cvsroot/tmda/tmda-cgi/CgiUtil.py,v
retrieving revision 1.22
retrieving revision 1.23
diff -u -r1.22 -r1.23
--- CgiUtil.py 12 Jun 2003 18:05:37 -0000 1.22
+++ CgiUtil.py 23 Aug 2003 18:55:52 -0000 1.23
@@ -183,3 +183,11 @@
# For now, show nothing.
return ""
+
+def TestTextFilePath(Path):
+ "Tests Path against regular expressions listed in AccessPaths (defaults.ini)"
+ Dict = {"Home": os.environ["HOME"]}
+ for Var in PVars.ThemeVars.options("AccessPaths"):
+ if re.search(PVars.ThemeVars.get("AccessPaths", Var, 1) % Dict, Path):
+ return 1
+ return None
Index: ChangeLog
===================================================================
RCS file: /cvsroot/tmda/tmda-cgi/ChangeLog,v
retrieving revision 1.59
retrieving revision 1.60
diff -u -r1.59 -r1.60
--- ChangeLog 23 Aug 2003 16:03:25 -0000 1.59
+++ ChangeLog 23 Aug 2003 18:55:52 -0000 1.60
@@ -1,3 +1,7 @@
+2003-08-23 Gre7g Luterman <[email protected]>
+
+ * Made sure users can only edit/view files in approved directories.
+
2003-08-22 Gre7g Luterman <[email protected]>
* Improved virtual-user domain guesser logic.
Index: EditFilter.py
===================================================================
RCS file: /cvsroot/tmda/tmda-cgi/EditFilter.py,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- EditFilter.py 28 Apr 2003 02:09:28 -0000 1.3
+++ EditFilter.py 23 Aug 2003 18:55:52 -0000 1.4
@@ -41,12 +41,15 @@
T["FilePath"] = Filename = CgiUtil.ExpandUser(Defaults.FILTER_OUTGOING)
# Get file
- try:
- F = open(Filename)
- T["FileContents"] = F.read()
- F.close()
- except IOError:
- T["FileContents"] = ""
+ if CgiUtil.TestTextFilePath(Filename):
+ try:
+ F = open(Filename)
+ T["FileContents"] = F.read()
+ F.close()
+ except IOError:
+ T["FileContents"] = ""
+ else:
+ T["FileContents"] = "(File is not accessible.)"
# Are we allowed to save?
if PVars[("NoOverride", "MayEditFilters")][0].lower() == "n":
@@ -64,16 +67,19 @@
Contents = re.sub("\n*$", "", Contents)
Contents += "\n"
- try:
- F = open(Filename, "w")
- F.write(Contents)
- F.close()
- T["FileContents"] = Contents
- except IOError, ErrStr:
- CgiUtil.TermError("Unable to save filter.",
- "Insufficient privileges", "save filter", "%s<br>%s" % (ErrStr,
- CgiUtil.FileDetails("Filter", Filename)),
- "Change file permissions on <tt>%s</tt>" % Filename)
+ if CgiUtil.TestTextFilePath(Filename):
+ try:
+ F = open(Filename, "w")
+ F.write(Contents)
+ F.close()
+ T["FileContents"] = Contents
+ except IOError, ErrStr:
+ CgiUtil.TermError("Unable to save filter.",
+ "Insufficient privileges", "save filter", "%s<br>%s" % (ErrStr,
+ CgiUtil.FileDetails("Filter", Filename)),
+ "Change file permissions on <tt>%s</tt>" % Filename)
+ else:
+ FileContents = "(File is not accessible.)"
# Display template
print T
Index: EditList.py
===================================================================
RCS file: /cvsroot/tmda/tmda-cgi/EditList.py,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- EditList.py 18 Aug 2003 23:43:21 -0000 1.7
+++ EditList.py 23 Aug 2003 18:55:52 -0000 1.8
@@ -81,12 +81,15 @@
# Get file
T["FilePath"] = EditFile
- try:
- F = open(EditFile)
- T["FileContents"] = List = F.read()
- F.close()
- except IOError:
- T["FileContents"] = ""
+ if CgiUtil.TestTextFilePath(EditFile):
+ try:
+ F = open(EditFile)
+ List = F.read()
+ F.close()
+ except IOError:
+ pass
+ else:
+ List = "(File is not accessible.)"
else:
# The user has no text-based lists defined in their filters.
@@ -132,15 +135,16 @@
List = re.sub("^\n*", "", List)
List += "\n"
- try:
- F = open(EditFile, "w")
- F.write(List)
- F.close()
- except IOError, ErrStr:
- CgiUtil.TermError("Unable to save filter list.",
- "Insufficient privileges", "save list", "%s<br>%s" % (ErrStr,
- CgiUtil.FileDetails("Filter list", EditFile)),
- "Change file permissions on <tt>%s</tt>" % EditFile)
+ if CgiUtil.TestTextFilePath(EditFile):
+ try:
+ F = open(EditFile, "w")
+ F.write(List)
+ F.close()
+ except IOError, ErrStr:
+ CgiUtil.TermError("Unable to save filter list.",
+ "Insufficient privileges", "save list", "%s<br>%s" % (ErrStr,
+ CgiUtil.FileDetails("Filter list", EditFile)),
+ "Change file permissions on <tt>%s</tt>" % EditFile)
# Display template
T["FileContents"] = List
Index: Session.py
===================================================================
RCS file: /cvsroot/tmda/tmda-cgi/Session.py,v
retrieving revision 1.36
retrieving revision 1.37
diff -u -r1.36 -r1.37
--- Session.py 21 Aug 2003 03:37:28 -0000 1.36
+++ Session.py 23 Aug 2003 18:55:52 -0000 1.37
@@ -255,6 +255,9 @@
def BecomeUser(self):
"Set up everything to *BE* the user."
+ Match = re.search("(.+)/$", self.Vars["HOME"])
+ if Match:
+ self.Vars["HOME"] = Match.group(1)
os.environ["HOME"] = self.Vars["HOME"]
self.__suid__("user")
self.Valid = 1
Index: Templates.py
===================================================================
RCS file: /cvsroot/tmda/tmda-cgi/Templates.py,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- Templates.py 9 Aug 2003 22:04:17 -0000 1.3
+++ Templates.py 23 Aug 2003 18:55:52 -0000 1.4
@@ -54,12 +54,15 @@
# Get file
T["FilePath"] = Filename
- try:
- F = open(Filename)
- FileContents = F.read()
- F.close()
- except IOError:
- FileContents = ""
+ if CgiUtil.TestTextFilePath(Filename):
+ try:
+ F = open(Filename)
+ FileContents = F.read()
+ F.close()
+ except IOError:
+ FileContents = ""
+ else:
+ FileContents = "(File is not accessible.)"
# Saving?
if Form.has_key("subcmd") and \
@@ -73,9 +76,10 @@
FileContents = re.sub("\n*$", "", FileContents)
FileContents += "\n"
- F = open(Filename, "w")
- F.write(FileContents)
- F.close()
+ if CgiUtil.TestTextFilePath(Filename):
+ F = open(Filename, "w")
+ F.write(FileContents)
+ F.close()
except IOError, ErrStr:
CgiUtil.TermError("Unable to save template file.",
"Insufficient privileges", "save template", "%s<br>%s" % (ErrStr,
Index: defaults.ini
===================================================================
RCS file: /cvsroot/tmda/tmda-cgi/defaults.ini,v
retrieving revision 1.20
retrieving revision 1.21
diff -u -r1.20 -r1.21
--- defaults.ini 22 May 2003 17:14:07 -0000 1.20
+++ defaults.ini 23 Aug 2003 18:55:52 -0000 1.21
@@ -81,3 +81,23 @@
BlockRemove = head,noframes,noscript,script,title
EmailClass = proportional
Headers = short
+
+# tmda-cgi allows users to view and/or edit text files such as filters, lists,
+# configuration files, and templates. These editors/viewers could be
+# exploited by a devious user. To minimize your risk, the AccessPaths section
+# allows you to specify where these files may be located. Unless a full file
+# path matches one of the regular expressions below, it will not be brought up
+# in an text box.
+#
+# Note: If you do not trust your users, be sure to set either
+# defaults.ini:
+# NoOverride:MayEditLocalConfig = No
+# or
+# /etc/tmdarc:
+# CONFIG_EXEC = 0
+# A devious user could easily put executable code in their local configuration
+# file which would allow them access to any file not protected by restrictive
+# file permissions.
+[AccessPaths]
+A = ^%(Home)s/
+B = ^/etc/tmdarc$
_______________________________________
tmda-cvs mailing list
http://tmda.net/lists/listinfo/tmda-cvs