From 811baa9bf50571bac372ddea0df5771fe1167d7b Mon Sep 17 00:00:00 2001 From: Renato Botelho Date: Wed, 18 Jun 2014 13:46:08 -0300 Subject: We need to allow subdirectories under /usr/local/pkg, here is the proper fix --- usr/local/www/pkg_edit.php | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/usr/local/www/pkg_edit.php b/usr/local/www/pkg_edit.php index faefc7d..d00ebd0 100755 --- a/usr/local/www/pkg_edit.php +++ b/usr/local/www/pkg_edit.php @@ -65,16 +65,14 @@ function domTT_title($title_msg){ $xml = htmlspecialchars($_GET['xml']); if($_POST['xml']) $xml = htmlspecialchars($_POST['xml']); -$xml = basename($xml); +$xml_fullpath = realpath('/usr/local/pkg/' . $xml); -if ($xml == "") { - print_info_box_np(gettext("ERROR: No package defined.")); - die; -} else if (!file_exists('/usr/local/pkg/' . $xml)) { - print_info_box_np(gettext("ERROR: XML file not found")); +if ($xml == "" || $xml_fullpath === false || + substr($xml_fullpath, 0, strlen('/usr/local/pkg/')) != '/usr/local/pkg/') { + print_info_box_np(gettext("ERROR: No valid package defined.")); die; } else { - $pkg = parse_xml_config_pkg("/usr/local/pkg/" . $xml, "packagegui"); + $pkg = parse_xml_config_pkg($xml_fullpath, "packagegui"); } if($pkg['include_file'] <> "") { -- cgit v1.1