Only check runscript dir when we are really executing the script.

bareos · Feb 17, 2015 · e5d0c53 · e5d0c53
1 parent 34951ea
commit e5d0c53
Showing 1 changed file with 12 additions and 10 deletions.
diff --git a/src/lib/runscript.c b/src/lib/runscript.c
@@ -152,15 +152,6 @@ int run_scripts(JCR *jcr, alist *runscripts, const char *label, alist *allowed_s
       Dmsg2(200, "runscript: try to run %s:%s\n", NPRT(script->target), NPRT(script->command));
       runit = false;
 
-      if (!script_dir_allowed(jcr, script, allowed_script_dirs)) {
-         Dmsg1(200, "runscript: Not running script %s because its not in one of the allowed scripts dirs\n",
-               script->command);
-         Jmsg(jcr, M_ERROR, 0, _("Runscript: run %s \"%s\" could not execute, "
-                                 "not in one of the allowed scripts dirs\n"), label, script->command);
-         jcr->setJobStatus(JS_ErrorTerminated);
-         goto bail_out;
-      }
-
       if ((script->when & SCRIPT_Before) && (when & SCRIPT_Before)) {
          if ((script->on_success && (jcr->JobStatus == JS_Running || jcr->JobStatus == JS_Created)) ||
              (script->on_failure && (job_canceled(jcr) || jcr->JobStatus == JS_Differences))) {
@@ -192,8 +183,19 @@ int run_scripts(JCR *jcr, alist *runscripts, const char *label, alist *allowed_s
          runit = false;
       }
 
-      /* we execute it */
+      /*
+       * We execute it
+       */
       if (runit) {
+         if (!script_dir_allowed(jcr, script, allowed_script_dirs)) {
+            Dmsg1(200, "runscript: Not running script %s because its not in one of the allowed scripts dirs\n",
+                  script->command);
+            Jmsg(jcr, M_ERROR, 0, _("Runscript: run %s \"%s\" could not execute, "
+                                    "not in one of the allowed scripts dirs\n"), label, script->command);
+            jcr->setJobStatus(JS_ErrorTerminated);
+            goto bail_out;
+         }
+
          script->run(jcr, label);
       }
    }