- For security reasons, I completely changed the handling of symbolic links:

[devedit.git] / modules / Tool.pm

diff --git a/modules/Tool.pm b/modules/Tool.pm
index e261f3e0de97ee0de179004d9aaafc2fba66f9bb..acc47220d5999748de0e0bb690d866db6b6c9734 100644 (file)
--- a/modules/Tool.pm
+++ b/modules/Tool.pm
@@ -6,7 +6,7 @@ package Tool;
 # Some shared sub routines
 #
 # Author:        Patrick Canterino <patrick@patshaping.de>
 # Some shared sub routines
 #
 # Author:        Patrick Canterino <patrick@patshaping.de>

-# Last modified: 2004-12-25
+# Last modified: 2005-02-12

 #
 
 use strict;
 #
 
 use strict;


@@ -54,31 +54,36 @@ sub check_path($$)
  $root = abs_path($root);
  $root = File::Spec->canonpath($root);
 
  $root = abs_path($root);
  $root = File::Spec->canonpath($root);
 

- $path =~ s!^/{1}!!;
- $path = $root."/".$path;
+ $path =~ tr!\\!/!;
+ $path =~ s!^/+!!;
+ $path =  $root.'/'.$path;

 
  # We extract the last part of the path and create the absolute path
 
  my $first = upper_path($path);
 
  # We extract the last part of the path and create the absolute path
 
  my $first = upper_path($path);

+ $first    = abs_path($first);
+

  my $last  = file_name($path);
  my $last  = file_name($path);

+ $last     = '' if($last eq '.');

 
 

- $first = abs_path($first);
- $path  = $first."/".$last;
+ if($last eq '..' || ($^O eq 'MSWin32' && $last =~ m!^\.\.\.+$!))
+ {
+  $first = abs_path($first.'/'.$last);
+  $last  = '';
+ }

 
 

- $first = File::Spec->canonpath($first);
- $path  = File::Spec->canonpath($path);
+ $path = File::Spec->canonpath($first.'/'.$last);

 
  # Check if the path is above the root directory
 
  return if(index($path,$root) != 0);
 
  # Check if the path is above the root directory
 
  return if(index($path,$root) != 0);

- return if($first eq $root && $last =~ m!^(/|\\)?\.\.(/|\\)?$!);

 
  # Create short path name
 
  my $short_path = substr($path,length($root));
 
  # Create short path name
 
  my $short_path = substr($path,length($root));

- $short_path =~ tr!\\!\/!;
- $short_path = "/".$short_path if($short_path !~ m!^/!);
- $short_path = $short_path."/" if($short_path !~ m!/$! && -d $path);
+ $short_path =~ tr!\\!/!;
+ $short_path = '/'.$short_path if($short_path !~ m!^/!);
+ $short_path = $short_path.'/' if($short_path !~ m!/$! && -d $path && not -l $path);

 
  return ($path,$short_path);
 }
 
  return ($path,$short_path);
 }


@@ -118,31 +123,31 @@ sub devedit_reload(;$)
  # Detect the protocol (simple HTTP or SSL encrypted HTTP)
  # and check if the server listens on the default port
 
  # Detect the protocol (simple HTTP or SSL encrypted HTTP)
  # and check if the server listens on the default port
 

- my $protocol = "";
- my $port     = "";
+ my $protocol = '';
+ my $port     = '';

 
  if(https)
  {
   # SSL encrypted HTTP (HTTPS)
 
 
  if(https)
  {
   # SSL encrypted HTTP (HTTPS)
 

-  $protocol = "https";
-  $port     = ":".$ENV{'SERVER_PORT'} if($ENV{'SERVER_PORT'} != 443);
+  $protocol = 'https';
+  $port     = ':'.$ENV{'SERVER_PORT'} if($ENV{'SERVER_PORT'} != 443);

  }
  else
  {
   # Simple HTTP
 
  }
  else
  {
   # Simple HTTP
 

-  $protocol = "http";
-  $port     = ":".$ENV{'SERVER_PORT'} if($ENV{'SERVER_PORT'} != 80);
+  $protocol = 'http';
+  $port     = ':'.$ENV{'SERVER_PORT'} if($ENV{'SERVER_PORT'} != 80);

  }
 
  # The following code is grabbed from Template::_query of
  # Andre Malo's selfforum (http://sourceforge.net/projects/selfforum/)
  # and modified by Patrick Canterino
 
  }
 
  # The following code is grabbed from Template::_query of
  # Andre Malo's selfforum (http://sourceforge.net/projects/selfforum/)
  # and modified by Patrick Canterino
 

- my $query = "";
+ my $query = '';

 
 

- if(ref($params) eq "HASH")
+ if(ref($params) eq 'HASH')

  {
   $query = '?'.join ('&' =>
     map {
  {
   $query = '?'.join ('&' =>
     map {


@@ -155,7 +160,7 @@ sub devedit_reload(;$)
 
  # Create the redirection header
 
 
  # Create the redirection header
 

- my $header = redirect($protocol."://".virtual_host.$port.$ENV{'SCRIPT_NAME'}.$query);
+ my $header = redirect($protocol.'://'.virtual_host.$port.$ENV{'SCRIPT_NAME'}.$query);

 
  return \$header;
 }
 
  return \$header;
 }


@@ -198,9 +203,9 @@ sub equal_url($$)
  my ($root,$path) = @_;
  my $url;
 
  my ($root,$path) = @_;
  my $url;
 

- $root =~ s!/$!!;
- $path =~ s!^/!!;
- $url  =  $root."/".$path;
+ $root =~ s!/+$!!;
+ $path =~ s!^/+!!;
+ $url  =  $root.'/'.$path;

 
  return $url;
 }
 
  return $url;
 }


@@ -218,10 +223,10 @@ sub file_name($)
  my $path =  shift;
  $path    =~ tr!\\!/!;
 
  my $path =  shift;
  $path    =~ tr!\\!/!;
 

- unless($path eq "/")
+ unless($path =~ m!^/+$! || ($^O eq 'MSWin32' && $path =~ m!^[a-z]:/+$!))

  {
  {

-  $path = substr($path,0,-1) if($path =~ m!/$!);
-  $path = substr($path,rindex($path,"/")+1);
+  $path =~ s!/+$!!;
+  $path =  substr($path,rindex($path,'/')+1);

  }
 
  return $path;
  }
 
  return $path;


@@ -239,35 +244,36 @@ sub file_name($)
 sub mode_string($)
 {
  my $mode   = shift;
 sub mode_string($)
 {
  my $mode   = shift;

- my $string = "";
+ my $string = '';

 
  # User
 
 
  # User
 

- $string  = ($mode & 00400) ? "r" : "-";
- $string .= ($mode & 00200) ? "w" : "-";
- $string .= ($mode & 00100) ? (($mode & 04000) ? "s" : "x") :
-                               ($mode & 04000) ? "S" : "-";
+ $string  = ($mode & 00400) ? 'r' : '-';
+ $string .= ($mode & 00200) ? 'w' : '-';
+ $string .= ($mode & 00100) ? (($mode & 04000) ? 's' : 'x') :
+                               ($mode & 04000) ? 'S' : '-';

 
  # Group
 
 
  # Group
 

- $string .= ($mode & 00040) ? "r" : "-";
- $string .= ($mode & 00020) ? "w" : "-";
- $string .= ($mode & 00010) ? (($mode & 02000) ? "s" : "x") :
-                               ($mode & 02000) ? "S" : "-";
+ $string .= ($mode & 00040) ? 'r' : '-';
+ $string .= ($mode & 00020) ? 'w' : '-';
+ $string .= ($mode & 00010) ? (($mode & 02000) ? 's' : 'x') :
+                               ($mode & 02000) ? 'S' : '-';

 
  # Other
 
 
  # Other
 

- $string .= ($mode & 00004) ? "r" : "-";
- $string .= ($mode & 00002) ? "w" : "-";
- $string .= ($mode & 00001) ? (($mode & 01000) ? "t" : "x") :
-                               ($mode & 01000) ? "T" : "-";
+ $string .= ($mode & 00004) ? 'r' : '-';
+ $string .= ($mode & 00002) ? 'w' : '-';
+ $string .= ($mode & 00001) ? (($mode & 01000) ? 't' : 'x') :
+                               ($mode & 01000) ? 'T' : '-';

 
  return $string;
 }
 
 # upper_path()
 #
 
  return $string;
 }
 
 # upper_path()
 #

-# Cut away the last part of a path
+# Remove the last part of a path
+# (the resulting path contains a trailing slash)

 #
 # Params: Path
 #
 #
 # Params: Path
 #


@@ -278,10 +284,10 @@ sub upper_path($)
  my $path =  shift;
  $path    =~ tr!\\!/!;
 
  my $path =  shift;
  $path    =~ tr!\\!/!;
 

- unless($path eq "/")
+ unless($path =~ m!^/+$! || ($^O eq 'MSWin32' && $path =~ m!^[a-z]:/+$!))

  {
  {

-  $path = substr($path,0,-1) if($path =~ m!/$!);
-  $path = substr($path,0,rindex($path,"/")+1);
+  $path =~ s!/+$!!;
+  $path =  substr($path,0,rindex($path,'/')+1);

  }
 
  return $path;
  }
 
  return $path;