michael/webmin
1
0
Fork 0
mirror of https://github.com/webmin/webmin.git synced 2026-09-23 05:50:39 +01:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Add checks for allowed .htaccess file path
Some checks failed
Tests / prove (push) Has been cancelled
Details
Package and upload artifacts / build (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Jamie Cameron
2026-09-18 16:57:34 -07:00
parent 5f020599de
commit 08d9ef3cd0
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
apache/apache-lib.pl
View File

@@ -1871,15 +1871,14 @@ return @rv;
}
# allowed_auth_file(file)
# Returns 1 if a .htaccess file can be edited by the current user
sub allowed_auth_file
{
local $_;
my ($file) = @_;
return 0 if ($file =~ /\.\./);
my $f = &server_root($file);
return 1 if ($access{'dir'} eq '/');
return 0 if ($_[0] =~ /\.\./);
local $f = &server_root($_[0]);
return 0 if (-l $f && !&allowed_auth_file(readlink($f)));
local $l = length($access{'dir'});
return length($f) >= $l && substr($f, 0, $l) eq $access{'dir'};
return &is_under_directory($access{'dir'}, $f);
}
# directory_exists(file)