diff options
| -rwxr-xr-x | LedgerSMB/Form.pm | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/LedgerSMB/Form.pm b/LedgerSMB/Form.pm index 0785caf5..9f37ad09 100755 --- a/LedgerSMB/Form.pm +++ b/LedgerSMB/Form.pm @@ -69,6 +69,7 @@ sub new { $self->{nextsub} =~ s/( |-|,|\#|\/|\.$)/_/g; } + $self->{menubar} = 1 if $self->{path} =~ /lynx/i; #menubar will be deprecated, replaced with below $self->{lynx} = 1 if $self->{path} =~ /lynx/i; @@ -78,6 +79,17 @@ sub new { bless $self, $type; + $self->{path} =~ s#\\#/#g; + if (($self->{path}) && ($self->{path} !~ m#^bin/#) + || ($self->{path} =~ m#(\w*/){2,}#)){ + $self->error("Access Denied"); + } + if (($self->{script} =~ m#(..|\\|/)#)){ + $self->error("Access Denied"); + } + + + if (($self->{action} =~ /:/) || ($self->{nextsub} =~ /:/)){ $self->error("Access Denied"); } |