File-Handling: sanitize filenames.

diff --git a/citadel/file_ops.c b/citadel/file_ops.c
index a3e8d749859590c8ea035e51a59f9ab010ea71b0..fa65f317171491fb3d9a86f543cdc663ebfdfe54 100644 (file)
--- a/citadel/file_ops.c
+++ b/citadel/file_ops.c
@@ -208,6 +208,12 @@ void cmd_open(char *cmdbuf)
                        ERROR + FILE_NOT_FOUND);
                return;
        }
+       if (strstr(filename, "../") != NULL)
+       {
+               cprintf("%d syntax error.\n",
+                       ERROR + ILLEGAL_VALUE);
+               return;
+       }
 
        if (CC->download_fp != NULL) {
                cprintf("%d You already have a download file open.\n",
@@ -289,6 +295,13 @@ void cmd_oimg(char *cmdbuf)
                                filename[a] = '_';
                        }
                }
+               if (strstr(filename, "../") != NULL)
+               {
+                       cprintf("%d syntax error.\n",
+                               ERROR + ILLEGAL_VALUE);
+                       return;
+               }
+
                snprintf(pathname, sizeof pathname,
                                 "%s/%s",
                                 ctdl_image_dir,