Merge pull request #2888 from webmin/dev/fix-restricted-archive-extraction

Fix archive extraction for directory-restricted users

CHANGELOG.md

@@ -14,6 +14,7 @@
 * Fix two-factor authentication validation to use the Webmin configuration and data directories passed by the caller
 * Fix HTML escaping of module, script and session fields on the Webmin Actions Log details page
 * Fix mailbox attachment option injection
+* Fix archive extraction bypassing Upload and Download directory restrictions
 * Fix path traversal and command injection in parameterized Custom Commands file editors
 * Fix MySQL/MariaDB manual editor ACL bypass
 * Fix MySQL database backups allowing restricted users to write files or save root-run settings outside their access limits

updown/index.cgi

@@ -204,12 +204,14 @@ if ($can_upload) {
 						$upload_group, $form) ] ]));
 		}
 
-	# Unzip files
-	print &ui_table_row($text{'index_zip'},
-		&ui_radio("zip", 0,
-			  [ [ 2, $text{'index_zipyes'} ],
-			    [ 1, $text{'yes'} ],
-			    [ 0, $text{'no'} ] ]));
+	if (&can_write_file("/")) {
+		# Offer extraction only when uploads are not directory-restricted
+		print &ui_table_row($text{'index_zip'},
+			&ui_radio("zip", 0,
+				  [ [ 2, $text{'index_zipyes'} ],
+				    [ 1, $text{'yes'} ],
+				    [ 0, $text{'no'} ] ]));
+		}
 
 	# Email notification
 	print &ui_table_row($text{'index_email2'},

updown/lang/en

@@ -62,6 +62,7 @@ upload_extracted=, and extracted files ..
 upload_deleted=, and extracted files before deleting archive ..
 upload_notcomp=Not a ZIP or TAR file
 upload_eemail=Missing email address to notify
+upload_eextractacl=Archive extraction is not allowed when uploads are limited to specific directories
 upload_saving=Saving file $1 ..
 upload_saved=.. wrote $1
 upload_unzipping=Extracting file $1 ..

updown/upload.cgi

@@ -49,6 +49,8 @@ for($i=0; defined($in{"upload$i"}); $i++) {
 		}
 	}
 $found || &error($text{'upload_enone'});
+$in{'zip'} && !&can_write_file("/") &&
+	&error($text{'upload_eextractacl'});
 &can_write_file($in{'dir'}) ||
 	&error(&text('upload_eaccess', "<tt>$in{'dir'}</tt>", $!));