From 4876aaa7fda57b0fe75cc766591feebf118f3b57 Mon Sep 17 00:00:00 2001
From: Ilia Ross <ilia@ross.gdn>
Date: Thu, 20 Aug 2026 14:31:21 +0200
Subject: [PATCH] Fix users and groups file paths escaping the allowed
 directories
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ⓘ Only the .htaccess path was checked against the allowed directories. The users and groups file paths could be absolute and were saved unchecked, then written to later.

V2
---
 htaccess-htpasswd/lang/en      | 2 ++
 htaccess-htpasswd/save_dir.cgi | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/htaccess-htpasswd/lang/en b/htaccess-htpasswd/lang/en
index f03c94ed0..58b330fd9 100644
--- a/htaccess-htpasswd/lang/en
+++ b/htaccess-htpasswd/lang/en
@@ -38,6 +38,8 @@ dir_eclash=This directory is already protected
 dir_edir=Missing or invalid directory
 dir_ecannot=You are not allowed to protect this directory
 dir_ecannotcreate=You are not allow to configure which directories are protected
+dir_ecannotfile=You are not allowed to use a users file in this directory
+dir_ecannotgfile=You are not allowed to use a groups file in this directory
 dir_efile=Missing or invalid users filename
 dir_ehtaccess=Failed to create Apache options file $1 : $2
 dir_ehtpasswd=Failed to create users file $1 : $2
diff --git a/htaccess-htpasswd/save_dir.cgi b/htaccess-htpasswd/save_dir.cgi
index 78260815b..06c0d872c 100755
--- a/htaccess-htpasswd/save_dir.cgi
+++ b/htaccess-htpasswd/save_dir.cgi
@@ -99,6 +99,7 @@ else {
 			}
 		}
 	-d $file && &error(&text('dir_efiledir', $file));
+	&can_access_dir($file) || &error($text{'dir_ecannotfile'});
 
 	# Parse groups file option
 	if (!$can_htgroups) {
@@ -124,6 +125,8 @@ else {
 			}
 		}
 	-d $gfile && &error(&text('dir_egfiledir', $gfile));
+	!$gfile || &can_access_dir($gfile) ||
+		&error($text{'dir_ecannotgfile'});
 
 	# Parse require option
 	@require = ( $in{'require_mode'} );