loncom/lchtmldir - diff

Return to lchtmldir CVS log

Up to [LON-CAPA] / loncom

version 1.18, 2007/04/10 20:32:13	version 1.19, 2007/08/22 19:03:04
Line 156 if($username ne $safeuser) {	Line 156 if($username ne $safeuser) {
#untaint the base directory require that the dir contain only	#untaint the base directory require that the dir contain only
# alphas, / numbers or underscores, and end in /$safeuser	# alphas, / numbers or underscores, and end in /$safeuser

$dir =~ /(^([\w\/\.\-]+))/;

my $dirtry1 = $1;

$dir =~ /$\/$safeuser/;	my ($allowed_dir) = ($dir =~ m{(^([/]\|$match_username)+)});
my $dirtry2 = $1;

if(($dirtry1 ne $dir) or ($dirtry2 ne $dir)) {	my $has_correct_end = ($dir =~ m{/\Q$safeuser\E$});

	if(($allowed_dir ne $dir) or (!$has_correct_end)) {
if ($DEBUG) {	if ($DEBUG) {
print("Directory $dir is not a valid home for $safeuser\n");	print("Directory $dir is not a valid home for $safeuser\n");
}	}
exit 5;	exit 5;
}	}


# As root, create the directory.	# As root, create the directory.

my $homedir = $dirtry1;	my $homedir = $allowed_dir;
my $fulldir = $homedir."/public_html";	my $fulldir = $homedir."/public_html";

if($DEBUG) {	if($DEBUG) {
print("Full directory path is: $fulldir \n");	print("Full directory path is: $fulldir \n");
}	}
if(!( -e $dirtry1)) {	if(!( -e $homedir)) {
if($DEBUG) {	if($DEBUG) {
print("User's home directory $dirtry1 does not exist\n");	print("User's home directory $homedir does not exist\n");
}	}
if ($authentication eq "unix:") {	if ($authentication eq "unix:") {
exit 6;	exit 6;