iarv/znc
1
0
Fork 0
mirror of https://github.com/znc/znc.git synced 2026-05-02 11:32:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Don't let web skin name ../../../../ access files outside of usual skins directories.

Browse Source 
Thanks for Jeriko One <jeriko.one@gmx.us> for finding and reporting this.
This commit is contained in:
Alexey Sokolov
2018-07-14 00:12:28 +01:00
parent d22fef8620
commit a4a5aeeb17
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/WebModules.cpp
View File

@@ -557,13 +557,15 @@ CWebSock::EPageReqResult CWebSock::PrintTemplate(const CString& sPageName,
}
CString CWebSock::GetSkinPath(const CString& sSkinName) {
CString sRet = CZNC::Get().GetZNCPath() + "/webskins/" + sSkinName;
const CString sSkin = sSkinName.Replace_n("/", "_").Replace_n(".", "_");
CString sRet = CZNC::Get().GetZNCPath() + "/webskins/" + sSkin;
if (!CFile::IsDir(sRet)) {
sRet = CZNC::Get().GetCurPath() + "/webskins/" + sSkinName;
sRet = CZNC::Get().GetCurPath() + "/webskins/" + sSkin;
if (!CFile::IsDir(sRet)) {
sRet = CString(_SKINDIR_) + "/" + sSkinName;
sRet = CString(_SKINDIR_) + "/" + sSkin;
}
}