From: pcanterino <>
Date: Thu, 10 Nov 2005 17:40:44 +0000 (+0000)
Subject: - Fixed a security problem:
X-Git-Tag: version_3_0_1
X-Git-Url: https://git.p6c8.net/devedit.git/commitdiff_plain/b20af44b8176a2c2b21577d8b1ddc5fea2d63c5c

- Fixed a security problem:
  It was possible to access files and directories above the virtual root
  directory beginning with the same string as the root directory.
  For example:
  If your root directory is "/var/www/user1" it was possible to access
  "/var/www/user10", "/var/www/user11" and so on.
- Updated version number to 3.0.1
- Updated Change Log
---

diff --git a/CHANGELOG b/CHANGELOG
index 8e144d2..1a772f1 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,17 @@
 Change Log for Dev-Editor
 =========================
 
+Version 3.0.1 (2005-11-10):
+===========================
+
+ Accessing files above the virtual root directory:
+ -------------------------------------------------
+ It was possible to access files and directories above the virtual root
+ directory beginning with the same string as the root directory.
+ For example:
+ If your root directory is "/var/www/user1" it was possible to access
+ "/var/www/user10", "/var/www/user11" and so on.
+
 Version 3.0 (2005-10-18):
 =========================
 
diff --git a/README b/README
index 6e44e2a..16cf24c 100644
--- a/README
+++ b/README
@@ -1,5 +1,5 @@
-ReadMe for Dev-Editor 3.0
-=========================
+ReadMe for Dev-Editor 3.0.1
+===========================
 
 Description
 -----------
diff --git a/devedit.pl b/devedit.pl
index 909550b..39588cf 100644
--- a/devedit.pl
+++ b/devedit.pl
@@ -1,7 +1,7 @@
 #!C:/Programme/Perl/bin/perl.exe -w
 
 #
-# Dev-Editor 3.0
+# Dev-Editor 3.0.1
 #
 # Dev-Editor's main program
 #
@@ -22,7 +22,7 @@ use Command;
 use Output;
 use Tool;
 
-$VERSION = '3.0';
+$VERSION = '3.0.1';
 
 # Path to configuration file
 # Change if necessary!
diff --git a/modules/Tool.pm b/modules/Tool.pm
index 16d5d72..5ed1ba2 100644
--- a/modules/Tool.pm
+++ b/modules/Tool.pm
@@ -6,7 +6,7 @@ package Tool;
 # Some shared sub routines
 #
 # Author:        Patrick Canterino <patrick@patshaping.de>
-# Last modified: 2005-07-23
+# Last modified: 2005-11-10
 #
 
 use strict;
@@ -81,6 +81,7 @@ sub check_path($$)
  # Check if the path is above the root directory
 
  return if(index($path,$root) != 0);
+ return if(substr($path,length($root)) && not File::Spec->file_name_is_absolute(substr($path,length($root))));
 
  # Create short path name