CVS: tmda-cgi CgiUtil.py,1.22,1.23 ChangeLog,1.59,1.60 EditFilter.py,1.3,1.4 EditList.py,1.7,1.8 Session.py,1.36,1.37 Templates.py,1.3,1.4 defaults.ini,1.20,1.21

Gre7g Luterman <[email protected]>
Newsgroups gmane.mail.spam.tmda.cvs
Message-ID <[email protected]>
Update of /cvsroot/tmda/tmda-cgi
In directory sc8-pr-cvs1:/tmp/cvs-serv756

Modified Files:
	CgiUtil.py ChangeLog EditFilter.py EditList.py Session.py 
	Templates.py defaults.ini 
Log Message:
Made sure users can only edit/view files in approved directories.


Index: CgiUtil.py
===================================================================
RCS file: /cvsroot/tmda/tmda-cgi/CgiUtil.py,v
retrieving revision 1.22
retrieving revision 1.23
diff -u -r1.22 -r1.23
--- CgiUtil.py	12 Jun 2003 18:05:37 -0000	1.22
+++ CgiUtil.py	23 Aug 2003 18:55:52 -0000	1.23
@@ -183,3 +183,11 @@
 
   # For now, show nothing.
   return ""
+
+def TestTextFilePath(Path):
+  "Tests Path against regular expressions listed in AccessPaths (defaults.ini)"
+  Dict = {"Home": os.environ["HOME"]}
+  for Var in PVars.ThemeVars.options("AccessPaths"):
+    if re.search(PVars.ThemeVars.get("AccessPaths", Var, 1) % Dict, Path):
+      return 1
+  return None

Index: ChangeLog
===================================================================
RCS file: /cvsroot/tmda/tmda-cgi/ChangeLog,v
retrieving revision 1.59
retrieving revision 1.60
diff -u -r1.59 -r1.60
--- ChangeLog	23 Aug 2003 16:03:25 -0000	1.59
+++ ChangeLog	23 Aug 2003 18:55:52 -0000	1.60
@@ -1,3 +1,7 @@
+2003-08-23  Gre7g Luterman  <[email protected]>
+
+	* Made sure users can only edit/view files in approved directories.
+
 2003-08-22  Gre7g Luterman  <[email protected]>
 
 	* Improved virtual-user domain guesser logic.

Index: EditFilter.py
===================================================================
RCS file: /cvsroot/tmda/tmda-cgi/EditFilter.py,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- EditFilter.py	28 Apr 2003 02:09:28 -0000	1.3
+++ EditFilter.py	23 Aug 2003 18:55:52 -0000	1.4
@@ -41,12 +41,15 @@
     T["FilePath"] = Filename = CgiUtil.ExpandUser(Defaults.FILTER_OUTGOING)
 
   # Get file
-  try:
-    F = open(Filename)
-    T["FileContents"] = F.read()
-    F.close()
-  except IOError:
-    T["FileContents"] = ""
+  if CgiUtil.TestTextFilePath(Filename):
+    try:
+      F = open(Filename)
+      T["FileContents"] = F.read()
+      F.close()
+    except IOError:
+      T["FileContents"] = ""
+  else:
+    T["FileContents"] = "(File is not accessible.)"
   
   # Are we allowed to save?
   if PVars[("NoOverride", "MayEditFilters")][0].lower() == "n":
@@ -64,16 +67,19 @@
       Contents = re.sub("\n*$", "", Contents)
       Contents += "\n"
 
-      try:
-        F = open(Filename, "w")
-        F.write(Contents)
-        F.close()
-        T["FileContents"] = Contents
-      except IOError, ErrStr:
-        CgiUtil.TermError("Unable to save filter.",
-        "Insufficient privileges", "save filter", "%s<br>%s" % (ErrStr,
-        CgiUtil.FileDetails("Filter", Filename)),
-        "Change file permissions on <tt>%s</tt>" % Filename)
+      if CgiUtil.TestTextFilePath(Filename):
+        try:
+          F = open(Filename, "w")
+          F.write(Contents)
+          F.close()
+          T["FileContents"] = Contents
+        except IOError, ErrStr:
+          CgiUtil.TermError("Unable to save filter.",
+          "Insufficient privileges", "save filter", "%s<br>%s" % (ErrStr,
+          CgiUtil.FileDetails("Filter", Filename)),
+          "Change file permissions on <tt>%s</tt>" % Filename)
+      else:
+        FileContents = "(File is not accessible.)"
 
   # Display template
   print T

Index: EditList.py
===================================================================
RCS file: /cvsroot/tmda/tmda-cgi/EditList.py,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- EditList.py	18 Aug 2003 23:43:21 -0000	1.7
+++ EditList.py	23 Aug 2003 18:55:52 -0000	1.8
@@ -81,12 +81,15 @@
 
     # Get file
     T["FilePath"] = EditFile
-    try:
-      F = open(EditFile)
-      T["FileContents"] = List = F.read()
-      F.close()
-    except IOError:
-      T["FileContents"] = ""
+    if CgiUtil.TestTextFilePath(EditFile):
+      try:
+        F = open(EditFile)
+        List = F.read()
+        F.close()
+      except IOError:
+        pass
+    else:
+      List = "(File is not accessible.)"
 
   else:
     # The user has no text-based lists defined in their filters.
@@ -132,15 +135,16 @@
       List = re.sub("^\n*", "", List)
       List += "\n"
 
-      try:
-        F = open(EditFile, "w")
-        F.write(List)
-        F.close()
-      except IOError, ErrStr:
-        CgiUtil.TermError("Unable to save filter list.",
-        "Insufficient privileges", "save list", "%s<br>%s" % (ErrStr,
-        CgiUtil.FileDetails("Filter list", EditFile)),
-        "Change file permissions on <tt>%s</tt>" % EditFile)
+      if CgiUtil.TestTextFilePath(EditFile):
+        try:
+          F = open(EditFile, "w")
+          F.write(List)
+          F.close()
+        except IOError, ErrStr:
+          CgiUtil.TermError("Unable to save filter list.",
+          "Insufficient privileges", "save list", "%s<br>%s" % (ErrStr,
+          CgiUtil.FileDetails("Filter list", EditFile)),
+          "Change file permissions on <tt>%s</tt>" % EditFile)
 
   # Display template
   T["FileContents"] = List

Index: Session.py
===================================================================
RCS file: /cvsroot/tmda/tmda-cgi/Session.py,v
retrieving revision 1.36
retrieving revision 1.37
diff -u -r1.36 -r1.37
--- Session.py	21 Aug 2003 03:37:28 -0000	1.36
+++ Session.py	23 Aug 2003 18:55:52 -0000	1.37
@@ -255,6 +255,9 @@
 
   def BecomeUser(self):
     "Set up everything to *BE* the user."
+    Match = re.search("(.+)/$", self.Vars["HOME"])
+    if Match:
+      self.Vars["HOME"] = Match.group(1)
     os.environ["HOME"] = self.Vars["HOME"]
     self.__suid__("user")
     self.Valid = 1

Index: Templates.py
===================================================================
RCS file: /cvsroot/tmda/tmda-cgi/Templates.py,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- Templates.py	9 Aug 2003 22:04:17 -0000	1.3
+++ Templates.py	23 Aug 2003 18:55:52 -0000	1.4
@@ -54,12 +54,15 @@
 
     # Get file
     T["FilePath"] = Filename
-    try:
-      F = open(Filename)
-      FileContents = F.read()
-      F.close()
-    except IOError:
-      FileContents = ""
+    if CgiUtil.TestTextFilePath(Filename):
+      try:
+        F = open(Filename)
+        FileContents = F.read()
+        F.close()
+      except IOError:
+        FileContents = ""
+    else:
+      FileContents = "(File is not accessible.)"
 
     # Saving?
     if Form.has_key("subcmd") and \
@@ -73,9 +76,10 @@
         FileContents = re.sub("\n*$", "", FileContents)
         FileContents += "\n"
 
-        F = open(Filename, "w")
-        F.write(FileContents)
-        F.close()
+        if CgiUtil.TestTextFilePath(Filename):
+          F = open(Filename, "w")
+          F.write(FileContents)
+          F.close()
       except IOError, ErrStr:
         CgiUtil.TermError("Unable to save template file.",
         "Insufficient privileges", "save template", "%s<br>%s" % (ErrStr,

Index: defaults.ini
===================================================================
RCS file: /cvsroot/tmda/tmda-cgi/defaults.ini,v
retrieving revision 1.20
retrieving revision 1.21
diff -u -r1.20 -r1.21
--- defaults.ini	22 May 2003 17:14:07 -0000	1.20
+++ defaults.ini	23 Aug 2003 18:55:52 -0000	1.21
@@ -81,3 +81,23 @@
 BlockRemove = head,noframes,noscript,script,title
 EmailClass  = proportional
 Headers     = short
+
+# tmda-cgi allows users to view and/or edit text files such as filters, lists,
+# configuration files, and templates.  These editors/viewers could be
+# exploited by a devious user.  To minimize your risk, the AccessPaths section
+# allows you to specify where these files may be located.  Unless a full file
+# path matches one of the regular expressions below, it will not be brought up
+# in an text box.
+#
+# Note: If you do not trust your users, be sure to set either
+#   defaults.ini:
+#        NoOverride:MayEditLocalConfig = No
+# or
+#   /etc/tmdarc:
+#        CONFIG_EXEC = 0
+# A devious user could easily put executable code in their local configuration
+# file which would allow them access to any file not protected by restrictive
+# file permissions.
+[AccessPaths]
+A           = ^%(Home)s/
+B           = ^/etc/tmdarc$

_______________________________________
tmda-cvs mailing list
http://tmda.net/lists/listinfo/tmda-cvs
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.