oqapi/webgui
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Block files with dangerous names from coming in via Storage untar.

Browse source
This commit is contained in:
Colin Kuskie 2010-08-11 15:46:02 -07:00
parent 9f724a7193
commit 13a222f6ce
3 changed files with 20 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/WebGUI/Storage.pm
View file

@ -1844,6 +1844,13 @@ sub untar {
}, ".");
$self->_changeOwner(@files);
##Prevent dangerous files from being added to the storage location via untar
FILE: foreach my $file (@files) {
my $blockname = $temp->block_extensions($file);
next FILE if $blockname eq $file;
$temp->renameFile($file, $blockname);
}
chdir $originalDir;
return $temp;
}