version 1.93, 2011/05/23 03:30:07 |
version 1.94, 2011/05/23 03:33:38 |
|
|
} |
} |
strlcpy(buf, cp, sizeof(buf)); |
strlcpy(buf, cp, sizeof(buf)); |
|
|
debug3("secure_filename: checking '%s'", buf); |
|
if (stat(buf, &st) < 0 || |
if (stat(buf, &st) < 0 || |
(st.st_uid != 0 && st.st_uid != uid) || |
(st.st_uid != 0 && st.st_uid != uid) || |
(st.st_mode & 022) != 0) { |
(st.st_mode & 022) != 0) { |
|
|
} |
} |
|
|
/* If are past the homedir then we can stop */ |
/* If are past the homedir then we can stop */ |
if (comparehome && strcmp(homedir, buf) == 0) { |
if (comparehome && strcmp(homedir, buf) == 0) |
debug3("secure_filename: terminating check at '%s'", |
|
buf); |
|
break; |
break; |
} |
|
/* |
/* |
* dirname should always complete with a "/" path, |
* dirname should always complete with a "/" path, |
* but we can be paranoid and check for "." too |
* but we can be paranoid and check for "." too |