Catch error of trying to download a non-readable file using URL manipulation

[devedit.git] / devedit.pl

diff --git a/devedit.pl b/devedit.pl
index d74a1bce0716a3e8f91ef9bd08c79af9164befde..783013da2fad79ef9df069b9bfd6a4f4efa280f4 100644 (file)
--- a/devedit.pl
+++ b/devedit.pl
@@ -6,7 +6,7 @@
 # Dev-Editor's main program
 #
 # Author:        Patrick Canterino <patrick@patshaping.de>
-# Last modified: 2006-08-24
+# Last modified: 2010-12-24
 #
 # Copyright (C) 1999-2000 Roland Bluethgen, Frank Schoenmann
 # Copyright (C) 2003-2009 Patrick Canterino
@@ -55,10 +55,17 @@ abort($config->{'errors'}->{'no_root_access'}) unless(-r $config->{'fileroot'} &
 my $cgi = new CGI;
 
 my $command = $cgi->param('command') || 'show';
-my $file    = $cgi->param('file')    || '/';
+my $file    = $cgi->param('file')    || $config->{'startdir'} || '/';
 my $curdir  = $cgi->param('curdir')  || '';
 my $newfile = $cgi->param('newfile') || '';
 
+# Check if the command is disabled
+
+if(is_disabled_command($config->{'disable_commands'},$command))
+{
+ abort($config->{'errors'}->{'command_disabled'},'/',{COMMAND => encode_html($command)});
+}
+
 # Create physical and virtual path for the new file
 
 my $new_physical = '';