summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rwxr-xr-xLedgerSMB/Form.pm12
1 files changed, 12 insertions, 0 deletions
diff --git a/LedgerSMB/Form.pm b/LedgerSMB/Form.pm
index 0785caf5..9f37ad09 100755
--- a/LedgerSMB/Form.pm
+++ b/LedgerSMB/Form.pm
@@ -69,6 +69,7 @@ sub new {
$self->{nextsub} =~ s/( |-|,|\#|\/|\.$)/_/g;
}
+
$self->{menubar} = 1 if $self->{path} =~ /lynx/i;
#menubar will be deprecated, replaced with below
$self->{lynx} = 1 if $self->{path} =~ /lynx/i;
@@ -78,6 +79,17 @@ sub new {
bless $self, $type;
+ $self->{path} =~ s#\\#/#g;
+ if (($self->{path}) && ($self->{path} !~ m#^bin/#)
+ || ($self->{path} =~ m#(\w*/){2,}#)){
+ $self->error("Access Denied");
+ }
+ if (($self->{script} =~ m#(..|\\|/)#)){
+ $self->error("Access Denied");
+ }
+
+
+
if (($self->{action} =~ /:/) || ($self->{nextsub} =~ /:/)){
$self->error("Access Denied");
}