Adding sanity checks to path and script

git-svn-id: https://ledger-smb.svn.sourceforge.net/svnroot/ledger-smb/branches/1.2@947 4979c152-3d1c-0410-bac9-87ea11338e46

1 files changed, 12 insertions, 0 deletions

diff --git a/LedgerSMB/Form.pm b/LedgerSMB/Form.pm
index 0785caf5..9f37ad09 100755
--- a/LedgerSMB/Form.pm
+++ b/LedgerSMB/Form.pm
@@ -69,6 +69,7 @@ sub new {
 		$self->{nextsub} =~ s/( |-|,|\#|\/|\.$)/_/g;
 	}
 
+
 	$self->{menubar} = 1 if $self->{path} =~ /lynx/i;
 	#menubar will be deprecated, replaced with below
 	$self->{lynx} = 1 if $self->{path} =~ /lynx/i;
@@ -78,6 +79,17 @@ sub new {
 
 	bless $self, $type;
 
+	$self->{path} =~ s#\\#/#g;
+	if (($self->{path}) && ($self->{path} !~ m#^bin/#) 
+				|| ($self->{path} =~ m#(\w*/){2,}#)){
+		$self->error("Access Denied");
+	}
+	if (($self->{script} =~ m#(..|\\|/)#)){
+		$self->error("Access Denied");
+	}
+		
+		
+
 	if (($self->{action} =~ /:/) || ($self->{nextsub} =~ /:/)){
 		$self->error("Access Denied");
 	}