[Slim-Checkins] r33835 - /7.7/trunk/server/Slim/Web/Template/NoWeb.pm

Author: mherger
Date: Tue Feb 14 05:36:09 2012
New Revision: 33835

URL: http://svn.slimdevices.com/slim?rev=33835&view=rev
Log:
Fixed Bug: 17841
Description: don't allow directory traversal outside the HTML base folder

Modified:
    7.7/trunk/server/Slim/Web/Template/NoWeb.pm

Modified: 7.7/trunk/server/Slim/Web/Template/NoWeb.pm
URL: http://svn.slimdevices.com/slim/7.7/trunk/server/Slim/Web/Template/NoWeb.pm?rev=33835&r1=33834&r2=33835&view=diff
==============================================================================
--- 7.7/trunk/server/Slim/Web/Template/NoWeb.pm (original)
+++ 7.7/trunk/server/Slim/Web/Template/NoWeb.pm Tue Feb 14 05:36:09 2012
@@ -172,6 +172,18 @@
 			$found = $fullpath;
 		}
 
+		# bug 17841 - don't allow directory traversal, ignore requests to files outside the HTML base directories
+		if ($found && $found =~ /\.\./) {
+			# we probably don't use Cwd anywhere else
+			require Cwd;
+			$found = Cwd::abs_path($found);
+			
+			# reset path if it's outside the skin path ($dir)
+			if ($found !~ m|$dir|) {
+				$found = '';
+			}
+		}
+
 		if ($found) {
 
 			main::INFOLOG && $log->is_info && $log->info("Found path $found");