Files
webmin/filemin/chown.cgi
Ilia Ross 04ae776e6a
Some checks failed
webmin.dev: webmin/webmin / build (push) Has been cancelled
Fix to validate action paths
* Note: Validate File Manager action name/file parameters as checked paths under the current directory and `allowed_paths` before operations, blocking traversal and symlink escapes.
2026-05-12 01:25:57 +02:00

65 lines
1.1 KiB
Perl
Executable File

#!/usr/local/bin/perl
require './filemin-lib.pl';
&ReadParse();
get_paths();
if (!$in{'owner'} || !$in{'group'}) {
&redirect("index.cgi?path=".&urlize($path));
}
(my $login, my $pass, my $uid, my $gid) =
getpwnam($in{'owner'});
my $grid = getgrnam($in{'group'});
my $recursive;
if ($in{'recursive'} eq 'true') {
$recursive = '-R';
}
else {
$recursive = '';
}
my @errors;
my @names = split(/\0/, $in{'name'});
my @files;
foreach my $name (@names) {
push(@files, [ $name, &validate_filename_path($name) ]);
}
if (!defined($login)) {
push @errors,
"<b>".&html_escape($in{'owner'})."</b> ".
$text{'error_user_not_found'};
}
if (!defined($grid)) {
push @errors,
"<b>".&html_escape($in{'group'})."</b> ".
$text{'error_group_not_found'};
}
if (scalar(@errors) > 0) {
print_errors(@errors);
}
else {
foreach my $file (@files) {
my ($name, $full) = @$file;
if (system_logged(
"chown $recursive $uid:$grid ".
quotemeta($full)) != 0) {
push @errors,
"$name - " .
"$text{'error_chown'}: $?";
}
}
if (scalar(@errors) > 0) {
print_errors(@errors);
}
else {
&redirect(
"index.cgi?path=".&urlize($path));
}
}