From 64ea56164ad8f0f2cee5676f84d2d8f064e986e1 Mon Sep 17 00:00:00 2001
From: Marius Cramer <m.cramer@pixcept.de>
Date: Tue, 29 Jul 2014 11:55:13 -0400
Subject: [PATCH] Improved input validation
---
server/lib/classes/system.inc.php | 26 +++++++++++++++++++++++++-
1 files changed, 25 insertions(+), 1 deletions(-)
diff --git a/server/lib/classes/system.inc.php b/server/lib/classes/system.inc.php
index d9d85e5..049eb61 100644
--- a/server/lib/classes/system.inc.php
+++ b/server/lib/classes/system.inc.php
@@ -34,7 +34,9 @@
var $server_id;
var $server_conf;
var $data;
-
+ var $min_uid = 500;
+ var $min_gid = 500;
+
/**
* Construct for this class
*
@@ -1816,6 +1818,28 @@
return true;
}
+ public function is_allowed_user($username, $check_id = true, $restrict_names = false) {
+ global $app;
+
+ if($username == 'root') return false;
+ if($check_id && intval($this->getuid($username)) < $this->min_uid) return false;
+
+ if($restrict_names == true && preg_match('/^web\d+$/', $username) == false) return false;
+
+ return true;
+ }
+
+ public function is_allowed_group($groupname, $restrict_names = false) {
+ global $app;
+
+ if($groupname == 'root') return false;
+ if(intval($this->getgid($groupname)) < $this->min_gid) return false;
+
+ if($restrict_names == true && preg_match('/^client\d+$/', $groupname) == false) return false;
+
+ return true;
+ }
+
}
?>
--
Gitblit v1.9.1