- Fixed a security problem:

[devedit.git] / modules / Tool.pm

diff --git a/modules/Tool.pm b/modules/Tool.pm
index 3ef4a10ec3aec602b323dea98db692bc1fea6ebb..5ed1ba238bf170786ecd099d33f3d65e8b7d7aaf 100644 (file)
--- a/modules/Tool.pm
+++ b/modules/Tool.pm
@@ -6,7 +6,7 @@ package Tool;
 # Some shared sub routines
 #
 # Author:        Patrick Canterino <patrick@patshaping.de>
 # Some shared sub routines
 #
 # Author:        Patrick Canterino <patrick@patshaping.de>

-# Last modified: 2005-07-23
+# Last modified: 2005-11-10

 #
 
 use strict;
 #
 
 use strict;


@@ -68,8 +68,9 @@ sub check_path($$)
  $first    = abs_path($first);
 
  my $last  = file_name($path);
  $first    = abs_path($first);
 
  my $last  = file_name($path);

+ $last     = '' if($last eq '.');

 
 

- if(-d $first.'/'.$last && (not -l $first.'/'.$last) && -r $first.'/'.$last && -x $first.'/'.$last)
+ if($last eq '..' || ($^O eq 'MSWin32' && $last =~ m!^\.\.\.+$!))

  {
   $first = abs_path($first.'/'.$last);
   $last  = '';
  {
   $first = abs_path($first.'/'.$last);
   $last  = '';


@@ -80,6 +81,7 @@ sub check_path($$)
  # Check if the path is above the root directory
 
  return if(index($path,$root) != 0);
  # Check if the path is above the root directory
 
  return if(index($path,$root) != 0);

+ return if(substr($path,length($root)) && not File::Spec->file_name_is_absolute(substr($path,length($root))));

 
  # Create short path name
 
 
  # Create short path name