12 Commits

Author	SHA1	Message	Date
Ilia Ross	99f35fa38a	Fix to move URL download destination controls to global ACL	2026-07-14 02:52:36 +02:00
Ilia Ross	934073532f	Fix to use the existing HTTP and FTP mode 7 callback	2026-07-14 02:27:10 +02:00
Ilia Ross	1555224592	Fix to refactor download address checks to use callback bundles ... ⓘ Extend HTTP and FTP download callbacks with destination validation while preserving legacy tracking callbacks and enforcing SSRF policy across redirects, proxies, caches, and direct/passive sockets. https://github.com/webmin/webmin/pull/2789#discussion_r3567985773	2026-07-13 13:36:34 +02:00
Ilia Ross	1ca52c9a97	Add ACL controls for URL download destinations ... Block non-public HTTP, HTTPS and FTP destinations by default in File Manager, Mailboxes and Upload and Download, with per-user IP/CIDR exceptions, redirect and proxy protection, cache isolation, and current-ACL enforcement for scheduled jobs.	2026-07-12 14:57:08 +02:00
Ilia Ross	04ae776e6a	Fix to validate action paths ... * Note: Validate File Manager action name/file parameters as checked paths under the current directory and `allowed_paths` before operations, blocking traversal and symlink escapes.	2026-05-12 01:25:57 +02:00
Ilia Ross	77e488b4b6	filemin: reindent and add function comments	2026-04-08 19:53:49 +02:00
Ilia Rostovtsev	cbc9c26194	Load ./lib only once in -lib file	2020-07-01 20:43:36 +03:00
Jamie Cameron	f93251569b	Clean up code, and set correct owner on downloaded files	2017-05-30 21:56:39 -07:00
Jamie Cameron	80ecd012cf	Make perl path consistent with the repo	2016-02-28 10:57:24 -08:00
Jamie Cameron	a59cd42151	Re-fork filemin from 1.783 release	2016-02-22 20:06:44 -08:00
Jamie Cameron	9ed6338db6	Undo filemin fork	2016-02-22 20:05:11 -08:00
Jamie Cameron	f98e8e3398	Bring filemin as of the last webmin release across to our own repo	2016-02-21 15:36:17 -08:00