- For security reasons, I completely changed the handling of symbolic links:

  Symbolic links are now treated as files, no matter where they point to. The
  user is just allowed to see the path where the link points to, he is allowed
  to delete the link, to rename it and to overwrite it by renaming an other
  file. Nothing else is allowed.
  Accessing a symbolic link pointing to a directory caused also a very strange
  effect: It was possible to access this directory, but you could not access the
  objects in it.
  I had to do it in this way because of the very stupid behaviour of abs_path()
  from the Cwd module: This function is just able to detect the absolute path of
  directories.
  Hard links are not affected by this, because it is not possible to detect them
  (at least I don't know how to detect them).
- Changed the names of two error messages:
  dircopy -> dir_copy
  editdir -> dir_edit
- Fixed various errors in some template files

diff --git a/errors.dat b/errors.dat
index 8ead289cb744d10e9c89918d43975da80d84b46b..5a54b08f1d21f6f9a54264b77ec1f1e06c3e8948 100644 (file)
--- a/errors.dat
+++ b/errors.dat
@@ -2,18 +2,19 @@
 
 above_root     = Accessing files and directories above the virtual root directory is forbidden.
 binary         = This editor is not able to view/edit binary files.
+chprop_link    = You are not allowed to change the properties of a symbolic link.
 chprop_root    = You are not allowed to change the properties of the root directory.
 cmd_unknown    = Unknown command: '{COMMAND}'
 copy_failed    = Could not copy '{FILE}' to '{NEW_FILE}'.
 create_ar      = You are not allowed to create files and directories above the virtual root directory.
 delete_failed  = Could not delete file '{FILE}'.
-dircopy        = This editor is not able to copy directories.
+dir_copy       = This editor is not able to copy directories.
+dir_edit       = You cannot edit directories.
 dir_no_create  = You have not enough permissions to create a file in directory '{DIR}'.
 dir_not_exist  = The directory where you want to create this file or directory does not exist.
 dir_read_fail  = Reading of directory '{DIR}' failed.
 dir_replace    = You are not allowed to replace a directory.
 edit_failed    = Saving of file '{FILE}' failed. The file could be damaged, please check its integrity.
-editdir        = You cannot edit directories.
 exist_edited   = The target file '{FILE}' already exists and is edited by someone else.
 exist_no_write = The target file '{FILE}' already exists and you have not enough permissions to replace it.
 file_exists    = A file or directory called '{FILE}' already exists.
@@ -21,6 +22,9 @@ file_too_large = The file you want to view or edit is too large (max. {SIZE}&nbs
 in_use         = The file '{FILE}' is currently edited by someone else.
 invalid_group  = '{GROUP}' seems to be an invalid group name. Please check it and try again.
 invalid_upload = It seems that something is wrong with the file upload you want to submit.
+link_copy      = Copying symbolic links does not work.
+link_edit      = For security reasons, you cannot edit the target file of a symbolic link.
+link_replace   = You are not allowed to overwrite symbolic links.
 lock_failed    = Locking of '{USELIST}' failed. Try it again in a moment. If the problem persists, ask the administrator to check the lock file ('{LOCK_FILE}') and to recreate it if necessary.
 mkdir_failed   = Could not create directory '{DIR}'.
 mkfile_failed  = Could not create file '{FILE}'.

diff --git a/modules/Command.pm b/modules/Command.pm
index adb62a78a9fd5b31434f7643ea39a1976669f2b9..cd3f6fbf8d43374f1f7951489624572226c88932 100644 (file)
--- a/modules/Command.pm
+++ b/modules/Command.pm
@@ -6,7 +6,7 @@ package Command;
 # Execute Dev-Editor's commands
 #
 # Author:        Patrick Canterino <patrick@patshaping.de>
-# Last modified: 2005-02-10
+# Last modified: 2005-02-12
 #
 
 use strict;
@@ -96,7 +96,7 @@ sub exec_show($$)
 
  my $tpl = new Template;
 
- if(-d $physical)
+ if(-d $physical && not -l $physical)
  {
   # Create directory listing
 
@@ -116,7 +116,7 @@ sub exec_show($$)
   my $filter2 = ($filter1 && $filter1 ne '*') ? $filter1 : ''; # Wildcard for output
 
   # Create the link to the upper directory
-  # (only if we are not in the root directory)
+  # (only if the current directory is not the root directory)
 
   unless($virtual eq '/')
   {
@@ -165,7 +165,7 @@ sub exec_show($$)
    my $phys_path = $physical.'/'.$file;
    my $virt_path = encode_entities($virtual.$file);
 
-   my @stat      = stat($phys_path);
+   my @stat      = lstat($phys_path);
    my $in_use    = $uselist->in_use($virtual.$file);
    my $too_large = $config->{'max_file_size'} && $stat[7] > $config->{'max_file_size'};
 
@@ -178,12 +178,14 @@ sub exec_show($$)
    $ftpl->fillin('DATE',encode_entities(strftime($config->{'timeformat'},($config->{'use_gmt'}) ? gmtime($stat[9]) : localtime($stat[9]))));
    $ftpl->fillin('URL',equal_url(encode_entities($config->{'httproot'}),$virt_path));
 
+   $ftpl->parse_if_block('link',-l $phys_path);
+   $ftpl->parse_if_block('no_link',not -l $phys_path);
    $ftpl->parse_if_block('not_readable',not -r $phys_path);
    $ftpl->parse_if_block('binary',-B $phys_path);
    $ftpl->parse_if_block('readonly',not -w $phys_path);
 
-   $ftpl->parse_if_block('viewable',-r $phys_path && -T $phys_path && not $too_large);
-   $ftpl->parse_if_block('editable',(-r $phys_path && -w $phys_path && -T $phys_path && not $too_large) && not $in_use);
+   $ftpl->parse_if_block('viewable',(-r $phys_path && -T $phys_path && not $too_large) || -l $phys_path);
+   $ftpl->parse_if_block('editable',((-r $phys_path && -w $phys_path && -T $phys_path && not $too_large) && not $in_use) && not -l $phys_path);
 
    $ftpl->parse_if_block('in_use',$in_use);
    $ftpl->parse_if_block('unused',not $in_use);
@@ -209,6 +211,21 @@ sub exec_show($$)
   $tpl->parse_if_block('filter',$filter2);
   $tpl->parse_if_block('gmt',$config->{'use_gmt'});
  }
+ elsif(-l $physical)
+ {
+  # Show the target of a symbolic link
+
+  my $link_target = readlink($physical);
+
+  $tpl->read_file($config->{'templates'}->{'viewlink'});
+
+  $tpl->fillin('FILE',encode_entities($virtual));
+  $tpl->fillin('DIR',$upper_path);
+  $tpl->fillin('URL',encode_entities(equal_url($config->{'httproot'},$virtual)));
+  $tpl->fillin('SCRIPT',$script);
+
+  $tpl->fillin('LINK_TARGET',encode_entities($link_target));
+ }
  else
  {
   # View a file
@@ -265,9 +282,10 @@ sub exec_beginedit($$)
  my $dir            = upper_path($virtual);
  my $uselist        = $data->{'uselist'};
 
- return error($config->{'errors'}->{'editdir'},$dir)                    if(-d $physical);
- return error($config->{'errors'}->{'in_use'}, $dir,{FILE => $virtual}) if($uselist->in_use($virtual));
- return error($config->{'errors'}->{'no_edit'},$dir)                    unless(-r $physical && -w $physical);
+ return error($config->{'errors'}->{'link_edit'},$dir)                    if(-l $physical);
+ return error($config->{'errors'}->{'dir_edit'}, $dir)                    if(-d $physical);
+ return error($config->{'errors'}->{'in_use'},   $dir,{FILE => $virtual}) if($uselist->in_use($virtual));
+ return error($config->{'errors'}->{'no_edit'},  $dir)                    unless(-r $physical && -w $physical);
 
  # Check on binary files
 
@@ -370,7 +388,8 @@ sub exec_endedit($$)
   return error($config->{'errors'}->{'in_use'},$dir,{FILE => $virtual}) if($uselist->in_use($virtual));
  }
 
- return error($config->{'errors'}->{'editdir'},$dir)        if(-d $physical);
+ return error($config->{'errors'}->{'link_edit'},$dir)      if(-l $physical);
+ return error($config->{'errors'}->{'dir_edit'},$dir)       if(-d $physical);
  return error($config->{'errors'}->{'no_edit'},$dir)        if(-e $physical && !(-r $physical && -w $physical));
  return error($config->{'errors'}->{'text_to_binary'},$dir) unless(-T $physical);
 
@@ -480,7 +499,7 @@ sub exec_upload($$)
  my $virtual        = $data->{'virtual'};
  my $cgi            = $data->{'cgi'};
 
- return error($config->{'errors'}->{'no_directory'},upper_path($virtual),{FILE => $virtual}) unless(-d $physical);
+ return error($config->{'errors'}->{'no_directory'},upper_path($virtual),{FILE => $virtual}) unless(-d $physical && not -l $physical);
  return error($config->{'errors'}->{'dir_no_create'},$virtual,{DIR => $virtual})             unless(-w $physical);
 
  if(my $uploaded_file = $cgi->param('uploaded_file'))
@@ -495,6 +514,7 @@ sub exec_upload($$)
 
   if(-e $file_phys)
   {
+   return error($config->{'errors'}->{'link_replace'},$virtual)                        if(-l $file_phys);
    return error($config->{'errors'}->{'dir_replace'},$virtual)                         if(-d $file_phys);
    return error($config->{'errors'}->{'exist_no_write'},$virtual,{FILE => $file_virt}) unless(-w $file_phys);
    return error($config->{'errors'}->{'file_exists'},$virtual,{FILE => $file_virt})    unless($cgi->param('overwrite'));
@@ -546,8 +566,9 @@ sub exec_copy($$)
  my $dir            = upper_path($virtual);
  my $new_physical   = $data->{'new_physical'};
 
- return error($config->{'errors'}->{'dircopy'},$dir) if(-d $physical);
- return error($config->{'errors'}->{'no_copy'},$dir) unless(-r $physical);
+ return error($config->{'errors'}->{'link_copy'},$dir) if(-l $physical);
+ return error($config->{'errors'}->{'dir_copy'},$dir)  if(-d $physical);
+ return error($config->{'errors'}->{'no_copy'},$dir)   unless(-r $physical);
 
  if($new_physical)
  {
@@ -558,6 +579,7 @@ sub exec_copy($$)
   if(-e $new_physical)
   {
    return error($config->{'errors'}->{'exist_edited'},$new_dir,{FILE => $new_virtual})   if($data->{'uselist'}->in_use($data->{'new_virtual'}));
+   return error($config->{'errors'}->{'link_replace'},$new_dir)                          if(-l $new_physical);
    return error($config->{'errors'}->{'dir_replace'},$new_dir)                           if(-d $new_physical);
    return error($config->{'errors'}->{'exist_no_write'},$new_dir,{FILE => $new_virtual}) unless(-w $new_physical);
 
@@ -633,7 +655,7 @@ sub exec_rename($$)
   if(-e $new_physical)
   {
    return error($config->{'errors'}->{'exist_edited'},$new_dir,{FILE => $new_virtual})   if($data->{'uselist'}->in_use($data->{'new_virtual'}));
-   return error($config->{'errors'}->{'dir_replace'},$new_dir)                           if(-d $new_physical);
+   return error($config->{'errors'}->{'dir_replace'},$new_dir)                           if(-d $new_physical && not -l $new_physical);
    return error($config->{'errors'}->{'exist_no_write'},$new_dir,{FILE => $new_virtual}) unless(-w $new_physical);
 
    if(not $data->{'cgi'}->param('confirmed'))
@@ -697,7 +719,7 @@ sub exec_remove($$)
  return error($config->{'errors'}->{'remove_root'},'/') if($virtual eq '/');
  return error($config->{'errors'}->{'no_delete'},$dir)  unless(-w upper_path($physical));
 
- if(-d $physical)
+ if(-d $physical && not -l $physical)
  {
   # Remove a directory
 
@@ -770,6 +792,7 @@ sub exec_chprop($$)
  return error($config->{'errors'}->{'no_users'},$dir,{FILE => $virtual})  unless($users);
  return error($config->{'errors'}->{'chprop_root'},'/')                   if($virtual eq '/');
  return error($config->{'errors'}->{'not_owner'},$dir,{FILE => $virtual}) unless(-o $physical);
+ return error($config->{'errors'}->{'chprop_link'},$dir)                  if(-l $physical);
  return error($config->{'errors'}->{'in_use'},$dir,{FILE => $virtual})    if($data->{'uselist'}->in_use($virtual));
 
  my $cgi   = $data->{'cgi'};

diff --git a/modules/File/Access.pm b/modules/File/Access.pm
index 4c4d0daafd56f3b32fb73c93e501383c560c7c6f..dd6403bffaaab0fe18e6b5baa02c946023faf34a 100644 (file)
--- a/modules/File/Access.pm
+++ b/modules/File/Access.pm
@@ -7,7 +7,7 @@ package File::Access;
 # using only one command
 #
 # Author:        Patrick Canterino <patrick@patshaping.de>
-# Last modified: 2005-02-10
+# Last modified: 2005-02-12
 #
 
 use strict;
@@ -46,7 +46,7 @@ $has_flock = eval { local $SIG{'__DIE__'}; flock(STDOUT,0); 1 };
 # Params: Directory
 #
 # Return: Hash reference: dirs  => directories
-#                         files => files
+#                         files => files and symbolic links
 
 sub dir_read($)
 {
@@ -72,7 +72,7 @@ sub dir_read($)
  {
   next if($entry eq '.' || $entry eq '..');
 
-  if(-d $dir.'/'.$entry)
+  if(-d $dir.'/'.$entry && not -l $dir.'/'.$entry)
   {
    push(@dirs,$entry);
   }

diff --git a/modules/Tool.pm b/modules/Tool.pm
index 2347445b267fc84df46a578c5d101aace39e7eca..acc47220d5999748de0e0bb690d866db6b6c9734 100644 (file)
--- a/modules/Tool.pm
+++ b/modules/Tool.pm
@@ -6,7 +6,7 @@ package Tool;
 # Some shared sub routines
 #
 # Author:        Patrick Canterino <patrick@patshaping.de>
-# Last modified: 2005-01-08
+# Last modified: 2005-02-12
 #
 
 use strict;
@@ -83,7 +83,7 @@ sub check_path($$)
  my $short_path = substr($path,length($root));
  $short_path =~ tr!\\!/!;
  $short_path = '/'.$short_path if($short_path !~ m!^/!);
- $short_path = $short_path.'/' if($short_path !~ m!/$! && -d $path);
+ $short_path = $short_path.'/' if($short_path !~ m!/$! && -d $path && not -l $path);
 
  return ($path,$short_path);
 }

diff --git a/templates.dat b/templates.dat
index 65472cc4118375e121bba50067ee64221dd66894..a3fcdb3800191fb54cc13690ae917bd6ea0e945d 100644 (file)
--- a/templates.dat
+++ b/templates.dat
@@ -19,5 +19,6 @@ mkfile          = templates/mkfile.htm
 renamefile      = templates/renamefile.htm
 upload          = templates/upload.htm
 viewfile        = templates/viewfile.htm
+viewlink        = templates/viewlink.htm
 
 # End of configuration file
\ No newline at end of file

diff --git a/templates/about.htm b/templates/about.htm
index 5ad69fc5e8bbcaa53cfa7a83ec76bbae0f3c55b4..4acc3df8aecc97a4a52543ef4a0aa7168aaf39ad 100644 (file)
--- a/templates/about.htm
+++ b/templates/about.htm
@@ -12,7 +12,7 @@
 
 <p>Dev-Editor {VERSION}</p>
 
-<p>&copy;&nbsp;1999-2000 Roland Bl&uuml;thgen, <a href="http://www.defined.de/" target="_blank">Frank Sch&ouml;nmann</a><br />
+<p>&copy;&nbsp;1999-2000 Roland Bl&uuml;thgen, <a href="http://www.defined.de/" target="_blank">Frank Sch&ouml;nmann</a><br>
 &copy;&nbsp;2003-2005 <a href="http://www.patshaping.de/" target="_blank">Patrick Canterino</a></p>
 
 <p><a href="http://devedit.sourceforge.net/" target="_blank">http://devedit.sourceforge.net/</a></p>

diff --git a/templates/confirm_unlock.htm b/templates/confirm_unlock.htm
index e620f1788de7b104ed97d6124a0016132fde94b6..f75f359cf956796c11b9bf4c9102d3b00497e411 100644 (file)
--- a/templates/confirm_unlock.htm
+++ b/templates/confirm_unlock.htm
@@ -23,5 +23,9 @@
 
 <p><input type="submit" value="Unlock file '{FILE}'"></p>
 </form>
+
+<hr>
+
+<p align="right"><a href="{SCRIPT}?command=about" target="_blank"><i>About Dev-Editor</i></a></p>
 </body>
 </html>
\ No newline at end of file

diff --git a/templates/dirlist_file.htm b/templates/dirlist_file.htm
index f08398ab054db788562dfcda294d1cad9577208f..5df126e013be7eb63427d420bec3a715897ae0f1 100644 (file)
--- a/templates/dirlist_file.htm
+++ b/templates/dirlist_file.htm
@@ -2,5 +2,5 @@
 <td align="right" style="white-space:nowrap">{SIZE}</td>
 <td style="padding-left:15pt;white-space:nowrap;">{DATE}{IF gmt} (GMT){ENDIF}</td>
 <td style="padding-left:15pt;white-space:nowrap;">{FILE_NAME}</td>
-<td style="padding-left:15pt;white-space:nowrap;">({IF viewable}<a href="{SCRIPT}?command=show&amp;file={FILE}">View</a>{ELSE}<span style="color:#C0C0C0" title="{IF not_readable}Not readable{ELSE}{IF binary}Binary file{ELSE}{IF too_large}File too large{ENDIF}{ENDIF}{ENDIF}">View</span>{ENDIF} | {IF editable}<a href="{SCRIPT}?command=beginedit&amp;file={FILE}">Edit</a>{ELSE}<span style="color:#C0C0C0" title="{IF not_readable}Not readable{ELSE}{IF readonly}Read only{ELSE}{IF binary}Binary file{ELSE}{IF too_large}File too large{ENDIF}{IF in_use}In use{ENDIF}{ENDIF}{ENDIF}{ENDIF}">Edit</span>{ENDIF} | <a href="{SCRIPT}?command=copy&amp;file={FILE}">Copy</a>{IF unused}{IF dir_writeable} | <a href="{SCRIPT}?command=rename&amp;file={FILE}">Rename</a> | <a href="{SCRIPT}?command=remove&amp;file={FILE}">Delete</a>{ENDIF}{ENDIF}{IF in_use} | <a href="{SCRIPT}?command=unlock&amp;file={FILE}">Unlock</a>{ENDIF} |{IF unused}{IF users} <a href="{SCRIPT}?command=chprop&amp;file={FILE}">Chmod/Chgrp</a> |{ENDIF}{ENDIF} <a href="{URL}" target="_blank">View in Browser</a>)</td>
+<td style="padding-left:15pt;white-space:nowrap;">({IF viewable}<a href="{SCRIPT}?command=show&amp;file={FILE}">View</a>{ELSE}<span style="color:#C0C0C0" title="{IF not_readable}Not readable{ELSE}{IF binary}Binary file{ELSE}{IF too_large}File too large{ENDIF}{ENDIF}{ENDIF}">View</span>{ENDIF} | {IF editable}<a href="{SCRIPT}?command=beginedit&amp;file={FILE}">Edit</a>{ELSE}<span style="color:#C0C0C0" title="{IF link}Symbolic link{ELSE}{IF not_readable}Not readable{ELSE}{IF readonly}Read only{ELSE}{IF binary}Binary file{ELSE}{IF too_large}File too large{ENDIF}{IF in_use}In use{ENDIF}{ENDIF}{ENDIF}{ENDIF}{ENDIF}">Edit</span>{ENDIF}{IF no_link} | <a href="{SCRIPT}?command=copy&amp;file={FILE}">Copy</a>{ENDIF}{IF unused}{IF dir_writeable} | <a href="{SCRIPT}?command=rename&amp;file={FILE}">Rename</a> | <a href="{SCRIPT}?command=remove&amp;file={FILE}">Delete</a>{ENDIF}{ENDIF}{IF no_link}{IF in_use} | <a href="{SCRIPT}?command=unlock&amp;file={FILE}">Unlock</a>{ENDIF} |{IF unused}{IF users} <a href="{SCRIPT}?command=chprop&amp;file={FILE}">Chmod/Chgrp</a> |{ENDIF}{ENDIF}{ELSE} |{ENDIF} <a href="{URL}" target="_blank">View in Browser</a>)</td>
 </tr>

diff --git a/templates/mkdir.htm b/templates/mkdir.htm
index 565e9042735dc1296a63d3ed799a7088d905e241..db8b11a4beb97a0f6c282dab2c70da74fd4d8cf4 100644 (file)
--- a/templates/mkdir.htm
+++ b/templates/mkdir.htm
@@ -22,7 +22,6 @@
 
 <hr>
 
-<p align="right"><a href="{SCRIPT}?command=about" target="_blank"><i>About Dev-Editor</i></a></p
-
+<p align="right"><a href="{SCRIPT}?command=about" target="_blank"><i>About Dev-Editor</i></a></p>
 </body>
 </html>
\ No newline at end of file

diff --git a/templates/mkfile.htm b/templates/mkfile.htm
index 66e2c8337196cf65f25f73f44deef5f5b3f9e558..7c6c05909522d7524ff77a79369d2f88f4882234 100644 (file)
--- a/templates/mkfile.htm
+++ b/templates/mkfile.htm
@@ -22,7 +22,6 @@
 
 <hr>
 
-<p align="right"><a href="{SCRIPT}?command=about" target="_blank"><i>About Dev-Editor</i></a></p
-
+<p align="right"><a href="{SCRIPT}?command=about" target="_blank"><i>About Dev-Editor</i></a></p>
 </body>
 </html>
\ No newline at end of file

diff --git a/templates/viewlink.htm b/templates/viewlink.htm
new file mode 100644 (file)
index 0000000..451cded
--- /dev/null
+++ b/templates/viewlink.htm
@@ -0,0 +1,34 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
+"http://www.w3.org/TR/html4/loose.dtd">
+
+<html>
+<head>
+<title>Target of symbolic link {FILE}</title>
+<meta http-equiv="content-type" content="text/html; charset=iso-8859-1">
+</head>
+<body bgcolor="#FFFFFF" text="#000000" link="#0000FF" vlink="#800080" alink="#FF0000">
+
+<h1>Target of symbolic link {FILE}</h1>
+
+<p>(equals <a href="{URL}" target="_blank">{URL}</a>)</p>
+
+<p><a href="{SCRIPT}?command=show&amp;file={DIR}">Back to {DIR}</a></p>
+
+<p>'{FILE}' is a symbolic link pointing to:<br>
+<tt>{LINK_TARGET}</tt></p>
+
+<p>For security reasons, you cannot access the target of this link.</p>
+
+<hr>
+
+<table border="0" width="100%">
+<tr>
+<form action="{SCRIPT}">
+<input type="hidden" name="command" value="show">
+<td>Go to directory/file: <input type="text" name="file" value="{FILE}"> <input type="submit" value="Go!"></td>
+</form>
+<td align="right"><a href="{SCRIPT}?command=about" target="_blank"><i>About Dev-Editor</i></a></td>
+</tr>
+</table>
+</body>
+</html>
\ No newline at end of file