File-Handling: sanitize filenames.

[citadel.git] / citadel / file_ops.c

diff --git a/citadel/file_ops.c b/citadel/file_ops.c
index 460e2a85b462df566385f4211d44f983d8b6d52e..5547c005e0a374c20df9be7a32753111a88c0282 100644 (file)
--- a/citadel/file_ops.c
+++ b/citadel/file_ops.c
@@ -37,67 +37,9 @@
 #include "msgbase.h"
 #include "citserver.h"
 #include "threads.h"
-
-#ifndef HAVE_SNPRINTF
-#include "snprintf.h"
-#endif
-
 #include "ctdl_module.h"
 #include "user_ops.h"
 
-/*
- * network_talking_to()  --  concurrency checker
- */
-static HashList *nttlist = NULL;
-int network_talking_to(const char *nodename, long len, int operation) {
-
-       int retval = 0;
-       HashPos *Pos = NULL;
-       void *vdata;
-
-       begin_critical_section(S_NTTLIST);
-
-       switch(operation) {
-
-               case NTT_ADD:
-                       if (nttlist == NULL) 
-                               nttlist = NewHash(1, NULL);
-                       Put(nttlist, nodename, len, NewStrBufPlain(nodename, len), HFreeStrBuf);
-                       syslog(LOG_DEBUG, "nttlist: added <%s>\n", nodename);
-                       break;
-               case NTT_REMOVE:
-                       if ((nttlist == NULL) ||
-                           (GetCount(nttlist) == 0))
-                               break;
-                       Pos = GetNewHashPos(nttlist, 1);
-                       if (GetHashPosFromKey (nttlist, nodename, len, Pos))
-                               DeleteEntryFromHash(nttlist, Pos);
-                       DeleteHashPos(&Pos);
-                       syslog(LOG_DEBUG, "nttlist: removed <%s>\n", nodename);
-
-                       break;
-
-               case NTT_CHECK:
-                       if ((nttlist == NULL) ||
-                           (GetCount(nttlist) == 0))
-                               break;
-                       if (GetHash(nttlist, nodename, len, &vdata))
-                               retval ++;
-                       syslog(LOG_DEBUG, "nttlist: have [%d] <%s>\n", retval, nodename);
-                       break;
-       }
-
-       end_critical_section(S_NTTLIST);
-       return(retval);
-}
-
-void cleanup_nttlist(void)
-{
-        begin_critical_section(S_NTTLIST);
-       DeleteHash(&nttlist);
-        end_critical_section(S_NTTLIST);
-}
-
 
 
 /*
@@ -261,6 +203,12 @@ void cmd_open(char *cmdbuf)
                        ERROR + FILE_NOT_FOUND);
                return;
        }
+       if (strstr(filename, "../") != NULL)
+       {
+               cprintf("%d syntax error.\n",
+                       ERROR + ILLEGAL_VALUE);
+               return;
+       }
 
        if (CC->download_fp != NULL) {
                cprintf("%d You already have a download file open.\n",
@@ -342,6 +290,13 @@ void cmd_oimg(char *cmdbuf)
                                filename[a] = '_';
                        }
                }
+               if (strstr(filename, "../") != NULL)
+               {
+                       cprintf("%d syntax error.\n",
+                               ERROR + ILLEGAL_VALUE);
+                       return;
+               }
+
                snprintf(pathname, sizeof pathname,
                                 "%s/%s",
                                 ctdl_image_dir,
@@ -641,10 +596,15 @@ void cmd_read(char *cmdbuf)
        long start_pos;
        size_t bytes;
        char buf[SIZ];
+       int rc;
 
        /* The client will transmit its requested offset and byte count */
        start_pos = extract_long(cmdbuf, 0);
        bytes = extract_int(cmdbuf, 1);
+       if ((start_pos < 0) || (bytes <= 0)) {
+               cprintf("%d you have to specify a value > 0.\n", ERROR + ILLEGAL_VALUE);
+               return;
+       }
 
        if (CC->download_fp == NULL) {
                cprintf("%d You don't have a download file open.\n",
@@ -657,7 +617,16 @@ void cmd_read(char *cmdbuf)
                bytes = sizeof(buf);
        }
 
-       fseek(CC->download_fp, start_pos, 0);
+       rc = fseek(CC->download_fp, start_pos, 0);
+       if (rc < 0) {
+               cprintf("%d your file is smaller then %ld.\n", ERROR + ILLEGAL_VALUE, start_pos);
+               syslog(LOG_ALERT, "your file %s is smaller then %ld. [%s]\n", 
+                      CC->upl_path, 
+                      start_pos,
+                      strerror(errno));
+
+               return;
+       }
        bytes = fread(buf, 1, bytes, CC->download_fp);
        if (bytes > 0) {
                /* Tell the client the actual byte count and transmit it */
@@ -687,6 +656,10 @@ void cmd_writ(char *cmdbuf)
                cprintf("%d You don't have an upload file open.\n", ERROR + RESOURCE_NOT_OPEN);
                return;
        }
+       if (bytes <= 0) {
+               cprintf("%d you have to specify a value > 0.\n", ERROR + ILLEGAL_VALUE);
+               return;
+       }
 
        if (bytes > 100000) {
                bytes = 100000;
@@ -811,6 +784,7 @@ void cmd_nuop(char *cmdbuf)
 CTDL_MODULE_INIT(file_ops)
 {
        if (!threading) {
+
                CtdlRegisterProtoHook(cmd_delf, "DELF", "Delete a file");
                CtdlRegisterProtoHook(cmd_movf, "MOVF", "Move a file");
                CtdlRegisterProtoHook(cmd_open, "OPEN", "Open a download file transfer");
@@ -823,7 +797,6 @@ CTDL_MODULE_INIT(file_ops)
                CtdlRegisterProtoHook(cmd_nuop, "NUOP", "Open a network spool file for upload");
                CtdlRegisterProtoHook(cmd_oimg, "OIMG", "Open an image file for download");
                CtdlRegisterProtoHook(cmd_uimg, "UIMG", "Upload an image file");
-               CtdlRegisterCleanupHook(cleanup_nttlist);
        }
         /* return our Subversion id for the Log */
        return "file_ops";