Permalink
Browse files

fixing problem with colons in documentroot of domain and openbasedir,…

… fixing problem with safe_exec executing unwanted binaries, fixes #1288

git-svn-id: file:///var/svn/trunk@2744 45fdb5c4-e40b-0410-b369-9aab4fe9a275
1 parent e8ef7e8 commit 5fa90ddbca2f6d61015e962022b87bac5c32d88f @flol committed May 11, 2010
@@ -26,11 +26,13 @@
function makeSecurePath($path)
{
$search = Array(
+ '#\:+#',
'#/+#',
'#\.+#',
'#\0+#'
);
$replace = Array(
+ '',
'/',
'.',
''
@@ -79,7 +79,7 @@ function safe_exec($exec_string, &$return_value = false)
$ok = false;
foreach($allowed_commands as $allowed_command)
{
- if(strpos($exec_string, $allowed_command) == 0
+ if(strpos($exec_string, $allowed_command) === 0
&& (strlen($exec_string) === ($allowed_command_pos = strlen($allowed_command)) || substr($exec_string, $allowed_command_pos, 1) === ' '))
{
$ok = true;
@@ -90,7 +90,7 @@
// VERSION INFO
-$version = '1.4.2.1';
+$version = '1.4.2.2';
$dbversion = '2';
?>
@@ -173,11 +173,11 @@ protected function composePhpOptions($domain)
if($domain['openbasedir_path'] == '1')
{
- $php_options_text.= ' php_admin_value open_basedir "' . $domain['customerroot'] . $_phpappendopenbasedir . "\"\n";
+ $php_options_text.= ' php_admin_value open_basedir "' . makeCorrectDir($domain['customerroot']) . $_phpappendopenbasedir . "\"\n";
}
else
{
- $php_options_text.= ' php_admin_value open_basedir "' . $domain['documentroot'] . $_phpappendopenbasedir . "\"\n";
+ $php_options_text.= ' php_admin_value open_basedir "' . makeCorrectDir($domain['documentroot']) . $_phpappendopenbasedir . "\"\n";
}
}
@@ -166,11 +166,11 @@ protected function composePhpOptions($domain)
{
if($domain['openbasedir_path'] == '0')
{
- $openbasedir = $domain['documentroot'] . ':' . $tmpdir . ':' . $this->settings['system']['mod_fcgid_peardir'] . ':' . $this->settings['system']['phpappendopenbasedir'];
+ $openbasedir = makeCorrectDir($domain['documentroot']) . ':' . $tmpdir . ':' . $this->settings['system']['mod_fcgid_peardir'] . ':' . $this->settings['system']['phpappendopenbasedir'];
}
else
{
- $openbasedir = $domain['customerroot'] . ':' . $tmpdir . ':' . $this->settings['system']['mod_fcgid_peardir'] . ':' . $this->settings['system']['phpappendopenbasedir'];
+ $openbasedir = makeCorrectDir($domain['customerroot']) . ':' . $tmpdir . ':' . $this->settings['system']['mod_fcgid_peardir'] . ':' . $this->settings['system']['phpappendopenbasedir'];
}
$openbasedir = explode(':', $openbasedir);

0 comments on commit 5fa90dd

Please sign in to comment.