From 08cc7f673c377bf88897743e340097e93f1e95f4 Mon Sep 17 00:00:00 2001 From: ftimme <ft@falkotimme.com> Date: Wed, 16 Jan 2013 09:30:05 -0500 Subject: [PATCH] - Changed regex for redirect path (Web sites, subdomains, vhost subdomains, alias domains) and web folder (vhost subdomains) so that ".." is not allowed (in order to prevent path traversals). - nginx: don't allow folders for proxy redirects (subdomains and alias domains); URL is required. - nginx: modified rewriting. --- install/sql/incremental/upd_0039.sql | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) diff --git a/install/sql/incremental/upd_0039.sql b/install/sql/incremental/upd_0039.sql index b5f6463..af8a5af 100644 --- a/install/sql/incremental/upd_0039.sql +++ b/install/sql/incremental/upd_0039.sql @@ -1,4 +1,4 @@ --- -------------------------------------------------------- +-- -------------------------------------------------------- -- -- Tabellenstruktur für Tabelle `web_database_user` @@ -26,6 +26,10 @@ -- -------------------------------------------------------- +INSERT INTO `web_database_user` SELECT NULL, `sys_userid`, `sys_groupid`, `sys_perm_user`, `sys_perm_group`, `sys_perm_other`, '0', `database_user`, `database_password` FROM `web_database` WHERE 1; + +-- -------------------------------------------------------- + UPDATE `web_database`, `web_database_user` SET `web_database`.`database_user_id` = `web_database_user`.`database_user_id` WHERE `web_database_user`.`database_user` = `web_database`.`database_user`; -- -------------------------------------------------------- -- Gitblit v1.9.1