gryf/wmaker
1
0
Fork 0
mirror of https://github.com/gryf/wmaker.git synced 2025-12-18 12:00:31 +01:00
Code Issues Projects Releases Wiki Activity

WUtil: Be more strict about base directory for wrmdirhier()

Browse Source 
The original code refused to delete anything not in $WMAKER_USER_ROOT, now
we go one step further and limit deletion inside 'Library' or 'Defaults'.
This commit is contained in:
John D Pell
2021-08-08 09:36:27 +02:00
committed by Carlos R. Mafra
parent 0c6ad643c8
commit 671db45007
1 changed files with 19 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
WINGs/proplist.c
View File

@@ -1824,7 +1824,7 @@ static int wrmdirhier_fn(const char *path, const struct stat *st,
/*
* remove a directory hierarchy
*
* refuses to remove anything outside $WMAKER_USER_ROOT
* refuses to remove anything outside $WMAKER_USER_ROOT/Defaults or $WMAKER_USER_ROOT/Library
*
* returns 1 on success, 0 on failure
*
@@ -1834,15 +1834,27 @@ static int wrmdirhier_fn(const char *path, const struct stat *st,
*/
int wrmdirhier(const char *path)
{
const char *libpath;
char *udefpath = NULL;
struct stat st;
int error;
const char *t;
/* Only remove directories under $WMAKER_USER_ROOT */
if ((t = wusergnusteppath()) == NULL)
return EPERM;
if (strncmp(path, t, strlen(t)) != 0)
return EPERM;
/* Only remove directories under $WMAKER_USER_ROOT/Defaults or $WMAKER_USER_ROOT/Library */
libpath = wuserdatapath();
if (strncmp(path, libpath, strlen(libpath)) == 0)
if (path[strlen(libpath)] == '/')
goto path_in_valid_tree;
udefpath = wdefaultspathfordomain("");
if (strncmp(path, udefpath, strlen(udefpath)) == 0)
/* Note: by side effect, 'udefpath' already contains a final '/' */
goto path_in_valid_tree;
wfree(udefpath);
return EPERM;
path_in_valid_tree:
wfree(udefpath);
/* Shortcut if it doesn't exist to begin with */
if (stat(path, &st) == -1)