psychon c7583c4946 Fix a low impact directory traversal bug ...

A common pattern for checking directories in ZNC is the following:

	sAbsolutePath = CDir::ChangeDir(sAllowedPath, sFile);
	if (sAbsolutePath.Left(sAllowedPath.length()) != sAllowedPath)
		Error;

But there is a problem: If sAllowedPath doesn't end with a slash, we are
vulnerable to an attack. If e.g. sAllowedPath = "/foo/bar", then
sFile = "../bartender" would result in sAbsolutePath = "/foo/bartender". Since
this path does begin with sAllowedPath, the code allowed it.

There shouldn't be any places where this can be exploited currently, but it is
still a security bug (path traversal).


git-svn-id: https://znc.svn.sourceforge.net/svnroot/znc/trunk@1569 726aef4b-f618-498e-8847-2d620e286838

2009-07-21 18:36:33 +00:00

..

webadmin/skins

Pulled in CString changes from my common repository to help facilitate the upcoming webmods changes

2009-06-10 05:48:12 +00:00

admin.cpp

made string, boolean and integer static

2009-06-10 19:16:20 +00:00

autoattach.cpp

Happy New Year 2009 everyone!

2009-01-01 12:22:21 +00:00

autocycle.cpp

Happy New Year 2009 everyone!

2009-01-01 12:22:21 +00:00

autoop.cpp

autoop: Use const_iterator instead of iterator where it makes sense

2009-03-29 12:23:59 +00:00

away.cpp

Don't ever ask for a password via stdin in away and savebuff

2009-02-20 19:15:31 +00:00

awaynick.cpp

Happy New Year 2009 everyone!

2009-01-01 12:22:21 +00:00

chansaver.cpp

Happy New Year 2009 everyone!

2009-01-01 12:22:21 +00:00

crypt.cpp

Happy New Year 2009 everyone!

2009-01-01 12:22:21 +00:00

email.cpp

Fix a compiler warning in email

2009-04-05 19:09:03 +00:00

fail2ban.cpp

fail2ban: Clear all bans on rehash

2009-07-15 18:28:03 +00:00

imapauth.cpp

Use that new define everywhere

2009-01-25 16:51:54 +00:00

keepnick.cpp

Happy New Year 2009 everyone!

2009-01-01 12:22:21 +00:00

kickrejoin.cpp

Happy New Year 2009 everyone!

2009-01-01 12:22:21 +00:00

Makefile.in

modperl also needs -Wno-missing-declarations

2009-04-26 10:14:42 +00:00

modperl.cpp

Add and use CZNCSock instead of Csock everywhere

2009-06-29 11:26:19 +00:00

modperl.pm

Use znc.in instead of znc.com

2008-08-30 09:00:21 +00:00

nickserv.cpp

I suck (I broke the build!)

2009-07-01 09:11:33 +00:00

partyline.cpp

partyline: Fix the KICK sent for deleted users

2009-04-09 08:22:20 +00:00

perform.cpp

Add a "swap" command to perform to change the order of commands

2009-07-08 20:17:47 +00:00

q.cpp

Happy New Year 2009 everyone!

2009-01-01 12:22:21 +00:00

raw.cpp

Happy New Year 2009 everyone!

2009-01-01 12:22:21 +00:00

sample.cpp

Happy New Year 2009 everyone!

2009-01-01 12:22:21 +00:00

saslauth.cpp

Move the saslauth copyright notice back into saslauth.cpp

2009-03-16 11:59:36 +00:00

savebuff.cpp

Don't ever ask for a password via stdin in away and savebuff

2009-02-20 19:15:31 +00:00

schat.cpp

Happy New Year 2009 everyone!

2009-01-01 12:22:21 +00:00

shell.cpp

Add and use CZNCSock instead of Csock everywhere

2009-06-29 11:26:19 +00:00

simple_away.cpp

Happy New Year 2009 everyone!

2009-01-01 12:22:21 +00:00

stickychan.cpp

stickychan: Accept a channel list as module arguments

2009-06-05 19:56:23 +00:00

watch.cpp

watch: Removed a bit too much in r1413.

2009-03-07 11:24:34 +00:00

webadmin.cpp

Fix a low impact directory traversal bug

2009-07-21 18:36:33 +00:00