gryf/wmaker
1
0
Fork 0
mirror of https://github.com/gryf/wmaker.git synced 2026-02-27 21:05:49 +01:00
Code Issues Projects Releases Wiki Activity

Revert "WUtil: Be more strict about base directory for wmkdirhier()"

Browse Source 
This reverts commit a0b283a60f,
as it breaks saving the history in ~GNUstep/.AppInfo/WindowMaker/History
by restricting modifications to either ~GNUstep/Defaults or ~GNUstep/Library.

Thanks to Paul Selig for reporting this issue.
This commit is contained in:
Carlos R. Mafra
2023-08-21 22:18:23 +01:00
parent 75f353bef4
commit 93b049356f
1 changed files with 9 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
WINGs/proplist.c
View File

@@ -1732,36 +1732,23 @@ Bool WMWritePropListToFile(WMPropList * plist, const char *path)
* file, and the last component is stripped off. the rest is the * file, and the last component is stripped off. the rest is the
* the hierarchy to be created. * the hierarchy to be created.
* *
* refuses to create anything outside $WMAKER_USER_ROOT/Defaults or $WMAKER_USER_ROOT/Library * refuses to create anything outside $WMAKER_USER_ROOT
* *
* returns 1 on success, 0 on failure * returns 1 on success, 0 on failure
*/ */
int wmkdirhier(const char *path) int wmkdirhier(const char *path)
{ {
const char *libpath; const char *t;
char *udefpath;
int cmp;
char *thePath = NULL, buf[1024]; char *thePath = NULL, buf[1024];
size_t p, plen; size_t p, plen;
struct stat st; struct stat st;
/* Only create directories under $WMAKER_USER_ROOT/Defaults or $WMAKER_USER_ROOT/Library */ /* Only create directories under $WMAKER_USER_ROOT */
libpath = wuserdatapath(); if ((t = wusergnusteppath()) == NULL)
if (strncmp(path, libpath, strlen(libpath)) == 0) return 0;
if (path[strlen(libpath)] == '/') if (strncmp(path, t, strlen(t)) != 0)
goto path_in_valid_tree; return 0;
udefpath = wdefaultspathfordomain("");
cmp = strncmp(path, udefpath, strlen(udefpath));
wfree(udefpath);
if (cmp == 0)
/* Note: by side effect, 'udefpath' already contains a final '/' */
goto path_in_valid_tree;
/* If we reach this point, the path is outside the allowed tree */
return 0;
path_in_valid_tree:
thePath = wstrdup(path); thePath = wstrdup(path);
/* Strip the trailing component if it is a file */ /* Strip the trailing component if it is a file */
p = strlen(thePath); p = strlen(thePath);
@@ -1784,6 +1771,7 @@ int wmkdirhier(const char *path)
} }
memset(buf, 0, sizeof(buf)); memset(buf, 0, sizeof(buf));
strncpy(buf, t, sizeof(buf) - 1);
p = strlen(buf); p = strlen(buf);
plen = strlen(thePath); plen = strlen(thePath);
@@ -1794,7 +1782,7 @@ int wmkdirhier(const char *path)
strncpy(buf, thePath, p); strncpy(buf, thePath, p);
if (mkdir(buf, 0777) == -1 && errno == EEXIST && if (mkdir(buf, 0777) == -1 && errno == EEXIST &&
stat(buf, &st) == 0 && !S_ISDIR(st.st_mode)) { stat(buf, &st) == 0 && !S_ISDIR(st.st_mode)) {
werror(_("Could not create path component %s"), buf); werror(_("Could not create component %s"), buf);
wfree(thePath); wfree(thePath);
return 0; return 0;
} }