diff options
| -rwxr-xr-x | LedgerSMB/AM.pm | 10 | ||||
| -rwxr-xr-x | bin/am.pl | 7 |
2 files changed, 7 insertions, 10 deletions
diff --git a/LedgerSMB/AM.pm b/LedgerSMB/AM.pm index be9e47fe..57c75cb3 100755 --- a/LedgerSMB/AM.pm +++ b/LedgerSMB/AM.pm @@ -1235,9 +1235,13 @@ sub check_template_name { my ($self, $myconfig, $form) = @_; my @allowedsuff = qw(css tex txt html xml); - if ($form->{file} =~ /\.\./){ + if ($form->{file} =~ /^(.:)*?\/|\.\.\/|^\//){ $form->error("Directory transversal not allowed."); } + my $userspath = ${main::userspath}; + if ($form->{file} =~ /^$userspath\//){ + $form->error("Not allowed to access $userspath/ with this method"); + } my $whitelisted = 0; for (@allowedsuff){ if ($form->{file} =~ /$_$/){ @@ -1248,8 +1252,8 @@ sub check_template_name { $form->error("Error: File is of type that is not allowed."); } - if ($form->{file} !~ /^$myconfig->{templates}/){ - $form->error("$!: $form->{file}") unless $form->{file} =~ /^css/; + if ($form->{file} !~ /^$myconfig->{templates}\//){ + $form->error("Not in a whitelisted directory: $form->{file}") unless $form->{file} =~ /^css\//; } } @@ -1591,13 +1591,6 @@ sub list_templates { sub display_form { - $form->{file} =~ s/^(.:)*?\/|\.\.\///g; - $form->{file} =~ s/^\/*//g; - $form->{file} =~ s/$userspath//; - $form->{file} =~ s/$memberfile//; - - $form->error("$!: $form->{file}") unless -f $form->{file}; - AM->load_template(\%myconfig, \%$form); $form->{title} = $form->{file}; |