iarv/znc
1
0
Fork 0
mirror of https://github.com/znc/znc.git synced 2026-05-02 19:42:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix a webadmin bug which was introduced in r1569

Browse Source 
The directory prefix checking which prevents path traversal exploits had a logic
error that made it always fail.


git-svn-id: https://znc.svn.sourceforge.net/svnroot/znc/trunk@1574 726aef4b-f618-498e-8847-2d620e286838
This commit is contained in:
psychon
2009-07-21 21:04:49 +00:00
parent e11dbf2290
commit 6c1014f200
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
modules/webadmin.cpp
View File

@@ -253,13 +253,13 @@ CString CWebAdminSock::GetAvailSkinsDir() {
CString CWebAdminSock::GetSkinDir() {
CString sAvailSkins = GetAvailSkinsDir();
CString sSkinDir = sAvailSkins + GetModule()->GetSkinName() + "/";
CString sDir = CDir::CheckPathPrefix("./", sSkinDir, "/");
CString sSkinDir = GetModule()->GetSkinName() + "/";
CString sDir = CDir::CheckPathPrefix(sAvailSkins, sSkinDir, "/");
// Via CheckPrefix() we check if someone tries to use e.g. a skin name
// with embed .. or such evilness.
if (!sDir.empty() && CFile::IsDir(sSkinDir)) {
return sSkinDir;
if (!sDir.empty() && CFile::IsDir(sDir)) {
return sDir + "/";
}
return m_pModule->GetModDataDir() + "/skins/default/";