Ilia Ross 9ceffce70f Fix local batch file imports to enforce file access ACLs ...

ⓘ This tightens local server-side batch file execution in the Users and Groups module.

Both user and group batch endpoints now read local batch files through a shared helper that enforces the module `batchdir` ACL, the user’s global file chooser ACL (`root` / `otherdirs`), and the configured `fileunix` read identity. Existing ACLs remain compatible by treating a missing `batchdir` as `/`, while an explicitly blank value denies local server batch files.

Regression coverage was added for allowed paths, denied paths, `otherdirs`, missing/blank `batchdir`, symlink escape rejection, and successful local batch reads.

----

Reproduction / verification steps:

1. Create a constrained Webmin user with access to the `Users and Groups` module.

2. Set the user's Global ACL:

   - Root directory for file browser: `/home/user1`
   - Other directories to allow: empty
   - Browse as Unix user: `nobody`

3. Set the user's `Users and Groups` module ACL:

   - Can view batch file form?: `Yes`
   - Batch files must be under directory: `/`

4. Create test files on the Webmin host:

   ```sh
   sudo mkdir -p /home/user1

   echo ROOT_SECRET_MARKER | sudo tee /root/batch-secret.txt >/dev/null
   sudo chown root:root /root/batch-secret.txt
   sudo chmod 600 /root/batch-secret.txt

   echo ALLOWED_BATCH_MARKER | sudo tee /home/user1/allowed.batch >/dev/null
   sudo chmod 644 /home/user1/allowed.batch

   sudo ln -sf /root/batch-secret.txt /home/user1/link-secret.batch

   echo ROOT_ONLY_ALLOWED_MARKER | sudo tee /home/user1/root-only.batch >/dev/null
   sudo chown root:root /home/user1/root-only.batch
   sudo chmod 600 /home/user1/root-only.batch
   ```

5. Log in to Webmin as the constrained user and request:

   ```text
   /useradmin/batch_exec.cgi?source=1&local=/root/batch-secret.txt
   /useradmin/gbatch_exec.cgi?source=1&local=/root/batch-secret.txt
   ```

   Expected fixed result:

   ```text
   Local file location is not allowed
   ```

6. Request an allowed readable file:

   ```text
   /useradmin/batch_exec.cgi?source=1&local=/home/user1/allowed.batch
   /useradmin/gbatch_exec.cgi?source=1&local=/home/user1/allowed.batch
   ```

   Expected fixed result:

   ```text
   Invalid action at line 1 : ALLOWED_BATCH_MARKER
   ```

7. Request a symlink inside the allowed directory that points outside it:

   ```text
   /useradmin/batch_exec.cgi?source=1&local=/home/user1/link-secret.batch
   /useradmin/gbatch_exec.cgi?source=1&local=/home/user1/link-secret.batch
   ```

   Expected fixed result:

   ```text
   Local file location is not allowed
   ```

8. Request a root-only file inside the allowed directory:

   ```text
   /useradmin/batch_exec.cgi?source=1&local=/home/user1/root-only.batch
   /useradmin/gbatch_exec.cgi?source=1&local=/home/user1/root-only.batch
   ```

   Expected fixed result:

   ```text
   Local file not found
   ```

The fixed behavior confirms that local batch file imports now enforce the configured global file ACL, reject symlink escapes, and read files using the configured Unix identity instead of the privileged Webmin process.

2026-07-07 00:29:14 +02:00

17 KiB

Executable File

Raw Blame History

View Raw