version 1.489.2.24, 2016/09/24 19:44:15
|
version 1.489.2.25, 2016/09/27 16:30:24
|
Line 1429 sub du2_handler {
|
Line 1429 sub du2_handler {
|
# If the requested path contains /../ or is: |
# If the requested path contains /../ or is: |
# |
# |
# 1. for a directory, and the path does not begin with one of: |
# 1. for a directory, and the path does not begin with one of: |
# (a) /home/httpd/html/res/<domain>/ |
# (a) /home/httpd/html/res/<domain> |
# (b) /home/httpd/html/res/userfiles/ |
# (b) /home/httpd/html/res/userfiles/ |
# (c) /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/userfiles |
# (c) /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/userfiles |
# or is: |
# or is: |
Line 1466 sub ls_handler {
|
Line 1466 sub ls_handler {
|
} |
} |
if (-e $ulsdir) { |
if (-e $ulsdir) { |
if(-d $ulsdir) { |
if(-d $ulsdir) { |
unless (($ulsdir =~ m{/home/httpd/html/(res/$LONCAPA::match_domain|userfiles)/}) || |
unless (($ulsdir =~ m{/home/httpd/html/(res/$LONCAPA::match_domain|userfiles/)}) || |
($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/userfiles/})) { |
($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/userfiles/})) { |
&Failure($client,"refused\n",$userinput); |
&Failure($client,"refused\n",$userinput); |
return 1; |
return 1; |
Line 1526 sub ls_handler {
|
Line 1526 sub ls_handler {
|
# If the requested path contains /../ or is: |
# If the requested path contains /../ or is: |
# |
# |
# 1. for a directory, and the path does not begin with one of: |
# 1. for a directory, and the path does not begin with one of: |
# (a) /home/httpd/html/res/<domain>/ |
# (a) /home/httpd/html/res/<domain> |
# (b) /home/httpd/html/res/userfiles/ |
# (b) /home/httpd/html/res/userfiles/ |
# (c) /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/userfiles |
# (c) /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/userfiles |
# or is: |
# or is: |
Line 1562 sub ls2_handler {
|
Line 1562 sub ls2_handler {
|
} |
} |
if (-e $ulsdir) { |
if (-e $ulsdir) { |
if(-d $ulsdir) { |
if(-d $ulsdir) { |
unless (($ulsdir =~ m{/home/httpd/html/(res/$LONCAPA::match_domain|userfiles)/}) || |
unless (($ulsdir =~ m{/home/httpd/html/(res/$LONCAPA::match_domain|userfiles/)}) || |
($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/userfiles/})) { |
($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/userfiles/})) { |
&Failure($client,"refused\n","$userinput"); |
&Failure($client,"refused\n","$userinput"); |
return 1; |
return 1; |
Line 1615 sub ls2_handler {
|
Line 1615 sub ls2_handler {
|
# If the requested path (after prepending) contains /../ or is: |
# If the requested path (after prepending) contains /../ or is: |
# |
# |
# 1. for a directory, and the path does not begin with one of: |
# 1. for a directory, and the path does not begin with one of: |
# (a) /home/httpd/html/res/<domain>/ |
# (a) /home/httpd/html/res/<domain> |
# (b) /home/httpd/html/res/userfiles/ |
# (b) /home/httpd/html/res/userfiles/ |
# (c) /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/userfiles |
# (c) /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/userfiles |
# (d) /home/httpd/html/priv/<domain>/ and client is the homeserver |
# (d) /home/httpd/html/priv/<domain>/ and client is the homeserver |
Line 1700 sub ls3_handler {
|
Line 1700 sub ls3_handler {
|
if (-e $ulsdir) { |
if (-e $ulsdir) { |
if(-d $ulsdir) { |
if(-d $ulsdir) { |
unless (($getpropath) || ($getuserdir) || |
unless (($getpropath) || ($getuserdir) || |
($ulsdir =~ m{/home/httpd/html/(res/$LONCAPA::match_domain|userfiles)/}) || |
($ulsdir =~ m{/home/httpd/html/(res/$LONCAPA::match_domain|userfiles/)}) || |
($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/userfiles/}) || |
($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/userfiles/}) || |
(($ulsdir =~ m{/home/httpd/html/priv/$LONCAPA::match_domain/}) && ($islocal))) { |
(($ulsdir =~ m{/home/httpd/html/priv/$LONCAPA::match_domain/}) && ($islocal))) { |
&Failure($client,"refused\n",$userinput); |
&Failure($client,"refused\n",$userinput); |