- For security reasons, I completely changed the handling of symbolic links:

[devedit.git] / modules / Command.pm

diff --git a/modules/Command.pm b/modules/Command.pm
index 4cea462504b7482fbf539576a6f3d0d9239f079c..cd3f6fbf8d43374f1f7951489624572226c88932 100644 (file)
--- a/modules/Command.pm
+++ b/modules/Command.pm
@@ -6,7 +6,7 @@ package Command;
 # Execute Dev-Editor's commands
 #
 # Author:        Patrick Canterino <patrick@patshaping.de>
 # Execute Dev-Editor's commands
 #
 # Author:        Patrick Canterino <patrick@patshaping.de>

-# Last modified: 2005-01-24
+# Last modified: 2005-02-12

 #
 
 use strict;
 #
 
 use strict;


@@ -96,7 +96,7 @@ sub exec_show($$)
 
  my $tpl = new Template;
 
 
  my $tpl = new Template;
 

- if(-d $physical)
+ if(-d $physical && not -l $physical)

  {
   # Create directory listing
 
  {
   # Create directory listing
 


@@ -116,7 +116,7 @@ sub exec_show($$)
   my $filter2 = ($filter1 && $filter1 ne '*') ? $filter1 : ''; # Wildcard for output
 
   # Create the link to the upper directory
   my $filter2 = ($filter1 && $filter1 ne '*') ? $filter1 : ''; # Wildcard for output
 
   # Create the link to the upper directory

-  # (only if we are not in the root directory)
+  # (only if the current directory is not the root directory)

 
   unless($virtual eq '/')
   {
 
   unless($virtual eq '/')
   {


@@ -165,7 +165,7 @@ sub exec_show($$)
    my $phys_path = $physical.'/'.$file;
    my $virt_path = encode_entities($virtual.$file);
 
    my $phys_path = $physical.'/'.$file;
    my $virt_path = encode_entities($virtual.$file);
 

-   my @stat      = stat($phys_path);
+   my @stat      = lstat($phys_path);

    my $in_use    = $uselist->in_use($virtual.$file);
    my $too_large = $config->{'max_file_size'} && $stat[7] > $config->{'max_file_size'};
 
    my $in_use    = $uselist->in_use($virtual.$file);
    my $too_large = $config->{'max_file_size'} && $stat[7] > $config->{'max_file_size'};
 


@@ -178,12 +178,14 @@ sub exec_show($$)
    $ftpl->fillin('DATE',encode_entities(strftime($config->{'timeformat'},($config->{'use_gmt'}) ? gmtime($stat[9]) : localtime($stat[9]))));
    $ftpl->fillin('URL',equal_url(encode_entities($config->{'httproot'}),$virt_path));
 
    $ftpl->fillin('DATE',encode_entities(strftime($config->{'timeformat'},($config->{'use_gmt'}) ? gmtime($stat[9]) : localtime($stat[9]))));
    $ftpl->fillin('URL',equal_url(encode_entities($config->{'httproot'}),$virt_path));
 

+   $ftpl->parse_if_block('link',-l $phys_path);
+   $ftpl->parse_if_block('no_link',not -l $phys_path);

    $ftpl->parse_if_block('not_readable',not -r $phys_path);
    $ftpl->parse_if_block('binary',-B $phys_path);
    $ftpl->parse_if_block('readonly',not -w $phys_path);
 
    $ftpl->parse_if_block('not_readable',not -r $phys_path);
    $ftpl->parse_if_block('binary',-B $phys_path);
    $ftpl->parse_if_block('readonly',not -w $phys_path);
 

-   $ftpl->parse_if_block('viewable',-r $phys_path && -T $phys_path && not $too_large);
-   $ftpl->parse_if_block('editable',(-r $phys_path && -w $phys_path && -T $phys_path && not $too_large) && not $in_use);
+   $ftpl->parse_if_block('viewable',(-r $phys_path && -T $phys_path && not $too_large) || -l $phys_path);
+   $ftpl->parse_if_block('editable',((-r $phys_path && -w $phys_path && -T $phys_path && not $too_large) && not $in_use) && not -l $phys_path);

 
    $ftpl->parse_if_block('in_use',$in_use);
    $ftpl->parse_if_block('unused',not $in_use);
 
    $ftpl->parse_if_block('in_use',$in_use);
    $ftpl->parse_if_block('unused',not $in_use);


@@ -209,6 +211,21 @@ sub exec_show($$)
   $tpl->parse_if_block('filter',$filter2);
   $tpl->parse_if_block('gmt',$config->{'use_gmt'});
  }
   $tpl->parse_if_block('filter',$filter2);
   $tpl->parse_if_block('gmt',$config->{'use_gmt'});
  }

+ elsif(-l $physical)
+ {
+  # Show the target of a symbolic link
+
+  my $link_target = readlink($physical);
+
+  $tpl->read_file($config->{'templates'}->{'viewlink'});
+
+  $tpl->fillin('FILE',encode_entities($virtual));
+  $tpl->fillin('DIR',$upper_path);
+  $tpl->fillin('URL',encode_entities(equal_url($config->{'httproot'},$virtual)));
+  $tpl->fillin('SCRIPT',$script);
+
+  $tpl->fillin('LINK_TARGET',encode_entities($link_target));
+ }

  else
  {
   # View a file
  else
  {
   # View a file


@@ -265,9 +282,10 @@ sub exec_beginedit($$)
  my $dir            = upper_path($virtual);
  my $uselist        = $data->{'uselist'};
 
  my $dir            = upper_path($virtual);
  my $uselist        = $data->{'uselist'};
 

- return error($config->{'errors'}->{'editdir'},$dir)                    if(-d $physical);
- return error($config->{'errors'}->{'in_use'}, $dir,{FILE => $virtual}) if($uselist->in_use($virtual));
- return error($config->{'errors'}->{'no_edit'},$dir)                    unless(-r $physical && -w $physical);
+ return error($config->{'errors'}->{'link_edit'},$dir)                    if(-l $physical);
+ return error($config->{'errors'}->{'dir_edit'}, $dir)                    if(-d $physical);
+ return error($config->{'errors'}->{'in_use'},   $dir,{FILE => $virtual}) if($uselist->in_use($virtual));
+ return error($config->{'errors'}->{'no_edit'},  $dir)                    unless(-r $physical && -w $physical);

 
  # Check on binary files
 
 
  # Check on binary files
 


@@ -279,8 +297,8 @@ sub exec_beginedit($$)
 
  # Lock the file...
 
 
  # Lock the file...
 

- $uselist->add_file($virtual);
- $uselist->save;
+ ($uselist->add_file($virtual) and
+  $uselist->save)              or return error($config->{'errors'}->{'ul_add_failed'},$dir,{FILE => $virtual});

 
  # ... and show the editing form
 
 
  # ... and show the editing form
 


@@ -315,9 +333,11 @@ sub exec_canceledit($$)
 {
  my ($data,$config) = @_;
  my $virtual        = $data->{'virtual'};
 {
  my ($data,$config) = @_;
  my $virtual        = $data->{'virtual'};

+ my $dir            = upper_path($virtual);
+ my $uselist        = $data->{'uselist'};

 
 

- file_unlock($data->{'uselist'},$virtual);
- return devedit_reload({command => 'show', file => upper_path($virtual)});
+ file_unlock($uselist,$virtual) or return error($config->{'errors'}->{'ul_rm_failed'},$dir,{FILE => $virtual, USELIST => $uselist->{'listfile'}});
+ return devedit_reload({command => 'show', file => $dir});

 }
 
 # exec_endedit()
 }
 
 # exec_endedit()


@@ -343,7 +363,7 @@ sub exec_endedit($$)
  # No other user of Dev-Editor will access the file during this
  # routine because of the concept of File::UseList.
 
  # No other user of Dev-Editor will access the file during this
  # routine because of the concept of File::UseList.
 

- file_unlock($uselist,$virtual);
+ file_unlock($uselist,$virtual) or return error($config->{'errors'}->{'ul_rm_failed'},$dir,{FILE => $virtual, USELIST => $uselist->{'listfile'}});

 
  # Normalize newlines
 
 
  # Normalize newlines
 


@@ -368,13 +388,14 @@ sub exec_endedit($$)
   return error($config->{'errors'}->{'in_use'},$dir,{FILE => $virtual}) if($uselist->in_use($virtual));
  }
 
   return error($config->{'errors'}->{'in_use'},$dir,{FILE => $virtual}) if($uselist->in_use($virtual));
  }
 

- return error($config->{'errors'}->{'editdir'},$dir)        if(-d $physical);
+ return error($config->{'errors'}->{'link_edit'},$dir)      if(-l $physical);
+ return error($config->{'errors'}->{'dir_edit'},$dir)       if(-d $physical);

  return error($config->{'errors'}->{'no_edit'},$dir)        if(-e $physical && !(-r $physical && -w $physical));
  return error($config->{'errors'}->{'text_to_binary'},$dir) unless(-T $physical);
 
  if(file_save($physical,\$content))
  {
  return error($config->{'errors'}->{'no_edit'},$dir)        if(-e $physical && !(-r $physical && -w $physical));
  return error($config->{'errors'}->{'text_to_binary'},$dir) unless(-T $physical);
 
  if(file_save($physical,\$content))
  {

-  # Saving of the file was successful!
+  # The file was successfully saved!

 
   return devedit_reload({command => 'show', file => $dir});
  }
 
   return devedit_reload({command => 'show', file => $dir});
  }


@@ -464,7 +485,7 @@ sub exec_mkdir($$)
 
 # exec_upload()
 #
 
 # exec_upload()
 #

-# Upload a file
+# Process a file upload

 #
 # Params: 1. Reference to user input hash
 #         2. Reference to config hash
 #
 # Params: 1. Reference to user input hash
 #         2. Reference to config hash


@@ -478,7 +499,7 @@ sub exec_upload($$)
  my $virtual        = $data->{'virtual'};
  my $cgi            = $data->{'cgi'};
 
  my $virtual        = $data->{'virtual'};
  my $cgi            = $data->{'cgi'};
 

- return error($config->{'errors'}->{'no_directory'},upper_path($virtual),{FILE => $virtual}) unless(-d $physical);
+ return error($config->{'errors'}->{'no_directory'},upper_path($virtual),{FILE => $virtual}) unless(-d $physical && not -l $physical);

  return error($config->{'errors'}->{'dir_no_create'},$virtual,{DIR => $virtual})             unless(-w $physical);
 
  if(my $uploaded_file = $cgi->param('uploaded_file'))
  return error($config->{'errors'}->{'dir_no_create'},$virtual,{DIR => $virtual})             unless(-w $physical);
 
  if(my $uploaded_file = $cgi->param('uploaded_file'))


@@ -493,6 +514,7 @@ sub exec_upload($$)
 
   if(-e $file_phys)
   {
 
   if(-e $file_phys)
   {

+   return error($config->{'errors'}->{'link_replace'},$virtual)                        if(-l $file_phys);

    return error($config->{'errors'}->{'dir_replace'},$virtual)                         if(-d $file_phys);
    return error($config->{'errors'}->{'exist_no_write'},$virtual,{FILE => $file_virt}) unless(-w $file_phys);
    return error($config->{'errors'}->{'file_exists'},$virtual,{FILE => $file_virt})    unless($cgi->param('overwrite'));
    return error($config->{'errors'}->{'dir_replace'},$virtual)                         if(-d $file_phys);
    return error($config->{'errors'}->{'exist_no_write'},$virtual,{FILE => $file_virt}) unless(-w $file_phys);
    return error($config->{'errors'}->{'file_exists'},$virtual,{FILE => $file_virt})    unless($cgi->param('overwrite'));


@@ -544,8 +566,9 @@ sub exec_copy($$)
  my $dir            = upper_path($virtual);
  my $new_physical   = $data->{'new_physical'};
 
  my $dir            = upper_path($virtual);
  my $new_physical   = $data->{'new_physical'};
 

- return error($config->{'errors'}->{'dircopy'},$dir) if(-d $physical);
- return error($config->{'errors'}->{'no_copy'},$dir) unless(-r $physical);
+ return error($config->{'errors'}->{'link_copy'},$dir) if(-l $physical);
+ return error($config->{'errors'}->{'dir_copy'},$dir)  if(-d $physical);
+ return error($config->{'errors'}->{'no_copy'},$dir)   unless(-r $physical);

 
  if($new_physical)
  {
 
  if($new_physical)
  {


@@ -556,6 +579,7 @@ sub exec_copy($$)
   if(-e $new_physical)
   {
    return error($config->{'errors'}->{'exist_edited'},$new_dir,{FILE => $new_virtual})   if($data->{'uselist'}->in_use($data->{'new_virtual'}));
   if(-e $new_physical)
   {
    return error($config->{'errors'}->{'exist_edited'},$new_dir,{FILE => $new_virtual})   if($data->{'uselist'}->in_use($data->{'new_virtual'}));

+   return error($config->{'errors'}->{'link_replace'},$new_dir)                          if(-l $new_physical);

    return error($config->{'errors'}->{'dir_replace'},$new_dir)                           if(-d $new_physical);
    return error($config->{'errors'}->{'exist_no_write'},$new_dir,{FILE => $new_virtual}) unless(-w $new_physical);
 
    return error($config->{'errors'}->{'dir_replace'},$new_dir)                           if(-d $new_physical);
    return error($config->{'errors'}->{'exist_no_write'},$new_dir,{FILE => $new_virtual}) unless(-w $new_physical);
 


@@ -631,7 +655,7 @@ sub exec_rename($$)
   if(-e $new_physical)
   {
    return error($config->{'errors'}->{'exist_edited'},$new_dir,{FILE => $new_virtual})   if($data->{'uselist'}->in_use($data->{'new_virtual'}));
   if(-e $new_physical)
   {
    return error($config->{'errors'}->{'exist_edited'},$new_dir,{FILE => $new_virtual})   if($data->{'uselist'}->in_use($data->{'new_virtual'}));

-   return error($config->{'errors'}->{'dir_replace'},$new_dir)                           if(-d $new_physical);
+   return error($config->{'errors'}->{'dir_replace'},$new_dir)                           if(-d $new_physical && not -l $new_physical);

    return error($config->{'errors'}->{'exist_no_write'},$new_dir,{FILE => $new_virtual}) unless(-w $new_physical);
 
    if(not $data->{'cgi'}->param('confirmed'))
    return error($config->{'errors'}->{'exist_no_write'},$new_dir,{FILE => $new_virtual}) unless(-w $new_physical);
 
    if(not $data->{'cgi'}->param('confirmed'))


@@ -695,7 +719,7 @@ sub exec_remove($$)
  return error($config->{'errors'}->{'remove_root'},'/') if($virtual eq '/');
  return error($config->{'errors'}->{'no_delete'},$dir)  unless(-w upper_path($physical));
 
  return error($config->{'errors'}->{'remove_root'},'/') if($virtual eq '/');
  return error($config->{'errors'}->{'no_delete'},$dir)  unless(-w upper_path($physical));
 

- if(-d $physical)
+ if(-d $physical && not -l $physical)

  {
   # Remove a directory
 
  {
   # Remove a directory
 


@@ -768,6 +792,7 @@ sub exec_chprop($$)
  return error($config->{'errors'}->{'no_users'},$dir,{FILE => $virtual})  unless($users);
  return error($config->{'errors'}->{'chprop_root'},'/')                   if($virtual eq '/');
  return error($config->{'errors'}->{'not_owner'},$dir,{FILE => $virtual}) unless(-o $physical);
  return error($config->{'errors'}->{'no_users'},$dir,{FILE => $virtual})  unless($users);
  return error($config->{'errors'}->{'chprop_root'},'/')                   if($virtual eq '/');
  return error($config->{'errors'}->{'not_owner'},$dir,{FILE => $virtual}) unless(-o $physical);

+ return error($config->{'errors'}->{'chprop_link'},$dir)                  if(-l $physical);

  return error($config->{'errors'}->{'in_use'},$dir,{FILE => $virtual})    if($data->{'uselist'}->in_use($virtual));
 
  my $cgi   = $data->{'cgi'};
  return error($config->{'errors'}->{'in_use'},$dir,{FILE => $virtual})    if($data->{'uselist'}->in_use($virtual));
 
  my $cgi   = $data->{'cgi'};


@@ -855,7 +880,7 @@ sub exec_unlock($$)
 
  if($data->{'cgi'}->param('confirmed'))
  {
 
  if($data->{'cgi'}->param('confirmed'))
  {

-  file_unlock($uselist,$virtual);
+  file_unlock($uselist,$virtual) or return error($config->{'errors'}->{'ul_rm_failed'},$dir,{FILE => $virtual, USELIST => $uselist->{'listfile'}});

   return devedit_reload({command => 'show', file => $dir});
  }
  else
   return devedit_reload({command => 'show', file => $dir});
  }
  else


@@ -921,7 +946,8 @@ sub exec_about($$)
 
  $tpl->fillin('PID',$$);
 
 
  $tpl->fillin('PID',$$);
 

- # Check if the functions getpwuid() and getgrgid() are available
+ # The following information is only available on systems supporting
+ # users and groups

 
  if($users)
  {
 
  if($users)
  {