From accfe5ed9238e8dba04ab2524fbc69cf3295739a Mon Sep 17 00:00:00 2001
From: ftimme <ft@falkotimme.com>
Date: Mon, 09 Apr 2012 18:20:08 -0400
Subject: [PATCH] - Fixed FS#2099.
---
server/plugins-available/shelluser_base_plugin.inc.php | 14 ++++++++++++++
1 files changed, 14 insertions(+), 0 deletions(-)
diff --git a/server/plugins-available/shelluser_base_plugin.inc.php b/server/plugins-available/shelluser_base_plugin.inc.php
index f411251..5c41863 100755
--- a/server/plugins-available/shelluser_base_plugin.inc.php
+++ b/server/plugins-available/shelluser_base_plugin.inc.php
@@ -72,6 +72,13 @@
$app->uses('system');
+ //* Check if the resulting path is inside the docroot
+ $web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".intval($data['new']['parent_domain_id']));
+ if(substr(realpath($data['new']['dir']),0,strlen($web['document_root'])) != $web['document_root']) {
+ $app->log('Directory of the shell user is outside of website docroot.',LOGLEVEL_WARN);
+ return false;
+ }
+
if($app->system->is_user($data['new']['puser'])) {
// Get the UID of the parent user
$uid = intval($app->system->getuid($data['new']['puser']));
@@ -121,6 +128,13 @@
$app->uses('system');
+ //* Check if the resulting path is inside the docroot
+ $web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".intval($data['new']['parent_domain_id']));
+ if(substr(realpath($data['new']['dir']),0,strlen($web['document_root'])) != $web['document_root']) {
+ $app->log('Directory of the shell user is outside of website docroot.',LOGLEVEL_WARN);
+ return false;
+ }
+
if($app->system->is_user($data['new']['puser'])) {
// Get the UID of the parent user
$uid = intval($app->system->getuid($data['new']['puser']));
--
Gitblit v1.9.1