From c7ff92cdcfd5d6f46ecf7e110e181fdc5f2ea04a Mon Sep 17 00:00:00 2001
From: einhverfr <einhverfr@4979c152-3d1c-0410-bac9-87ea11338e46>
Date: Wed, 21 Mar 2007 06:29:55 +0000
Subject: Adding some additional controls to Form.pm

git-svn-id: https://ledger-smb.svn.sourceforge.net/svnroot/ledger-smb/trunk@972 4979c152-3d1c-0410-bac9-87ea11338e46
---
 LedgerSMB/Form.pm | 10 ++++++++++
 1 file changed, 10 insertions(+)

(limited to 'LedgerSMB')

diff --git a/LedgerSMB/Form.pm b/LedgerSMB/Form.pm
index ffdd040a..ff436451 100755
--- a/LedgerSMB/Form.pm
+++ b/LedgerSMB/Form.pm
@@ -78,6 +78,16 @@ sub new {
 
 	bless $self, $type;
 
+	$self->{path} =~ s#\\#/#g;
+	if (($self->{path}) && ($self->{path} !~ m#^bin/#) 
+				|| ($self->{path} =~ m#(\w*/){2,}#)){
+		$self->error("Access Denied");
+	}
+	if (($self->{script} =~ m#(..|\\|/)#)){
+		$self->error("Access Denied");
+	}
+		
+
 	if (($self->{action} =~ /:/) || ($self->{nextsub} =~ /:/)){
 		$self->error("Access Denied");
 	}
-- 
cgit v1.2.3