michael/webmin
1
0
Fork 0
mirror of https://github.com/webmin/webmin.git synced 2026-10-20 11:10:40 +01:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Fix archive extraction for directory-restricted users

Browse Source 
This PR fixes archive extraction bypassing Upload and Download directory restrictions.

Automatic extraction is hidden and rejected when uploads are limited to specific directories.

Unrestricted users keep the existing extraction behavior.

ANT-2026-TPYPGDF0: Reported by Adam in email on October 11, 2026 at 01:05.
This commit is contained in:
Ilia Ross
2026-10-15 17:47:58 +02:00
parent 24cd92a061
commit 1bd44f6b1f
4 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@@ -11,6 +11,7 @@
* Fix two-factor authentication validation to use the Webmin configuration and data directories passed by the caller
* Fix HTML escaping of module, script and session fields on the Webmin Actions Log details page
* Fix mailbox attachment option injection
* Fix archive extraction bypassing Upload and Download directory restrictions
* Fix path traversal and command injection in parameterized Custom Commands file editors
* Fix MySQL/MariaDB manual editor ACL bypass
* Fix the logged in users list in Users and Groups module showing nobody when `who` prints ISO dates under a non-C locale or `sshd pts/N` lines from the logind backend [forum.virtualmin.com/t/138162](https://forum.virtualmin.com/t/138162)

14
updown/index.cgi
View File

@@ -204,12 +204,14 @@ if ($can_upload) {
$upload_group, $form) ] ]));
}
# Unzip files
print &ui_table_row($text{'index_zip'},
&ui_radio("zip", 0,
[ [ 2, $text{'index_zipyes'} ],
[ 1, $text{'yes'} ],
[ 0, $text{'no'} ] ]));
if (&can_write_file("/")) {
# Offer extraction only when uploads are not directory-restricted
print &ui_table_row($text{'index_zip'},
&ui_radio("zip", 0,
[ [ 2, $text{'index_zipyes'} ],
[ 1, $text{'yes'} ],
[ 0, $text{'no'} ] ]));
}
# Email notification
print &ui_table_row($text{'index_email2'},

1
updown/lang/en
View File

@@ -62,6 +62,7 @@ upload_extracted=, and extracted files ..
upload_deleted=, and extracted files before deleting archive ..
upload_notcomp=Not a ZIP or TAR file
upload_eemail=Missing email address to notify
upload_eextractacl=Archive extraction is not allowed when uploads are limited to specific directories
upload_saving=Saving file $1 ..
upload_saved=.. wrote $1
upload_unzipping=Extracting file $1 ..

2
updown/upload.cgi
View File

@@ -49,6 +49,8 @@ for($i=0; defined($in{"upload$i"}); $i++) {
}
}
$found || &error($text{'upload_enone'});
$in{'zip'} && !&can_write_file("/") &&
&error($text{'upload_eextractacl'});
&can_write_file($in{'dir'}) ||
&error(&text('upload_eaccess', "<tt>$in{'dir'}</tt>", $!));