Project

General

Profile

Actions

Bug #521

closed

SSI includes with sub-directory broken

Added by Anonymous over 16 years ago. Updated over 16 years ago.

Status:
Fixed
Priority:
Normal
Category:
mod_ssi
Target version:
-
ASK QUESTIONS IN Forums:

Description

The following patch should fix the SSI_INCLUDE for #include file="" when using sub-directory:


--- mod_ssi.c.dist      2006-02-10 13:33:00.000000000 -0500
+++ mod_ssi.c.new       2006-02-13 15:23:00.000000000 -0500
@@ -513,18 +513,18 @@

                if (file_path) {
                        /* current doc-root */
-                       if (NULL == (sl = strrchr(con->physical.path->ptr, '/'))) {
-                               buffer_copy_string(p->stat_fn, "/");
-                       } else {
-                               buffer_copy_string_len(p->stat_fn, con->physical.path->ptr, sl - con->physical.path->ptr + 1);
-                       }
-
-                       /* fn */
-                       if (NULL == (sl = strrchr(file_path, '/'))) {
-                               buffer_append_string(p->stat_fn, file_path);
-                       } else {
-                               buffer_append_string(p->stat_fn, sl + 1);
-                       }
+            //
+            // skip if file_path contains forbidden strings
+            if (file_path[0] == '/' || strstr(file_path, "../")) break;
+
+            if (NULL == (sl = strrchr(con->physical.path->ptr, '/'))) {
+                buffer_copy_string(p->stat_fn, "/");
+            } else {
+                buffer_copy_string_len(p->stat_fn, con->physical.path->ptr, sl - con->physical.path->ptr + 1);
+            }
+
+            buffer_append_string(p->stat_fn, file_path);
+
                } else {
                        /* virtual */
Actions #1

Updated by conny over 16 years ago

  • Status changed from New to Fixed
  • Resolution set to duplicate

Merging with the ticket #462.

Actions

Also available in: Atom