fateserver/log: clean chars in slot, time and log master
authorMichael Niedermayer <michael@niedermayer.cc>
Tue, 17 Oct 2017 16:02:53 +0000 (18:02 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Tue, 17 Oct 2017 16:10:38 +0000 (18:10 +0200)
Fixes: Directory Traversal

Found-by: Pankaj Jadhav <pankajj736@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
log.cgi

diff --git a/log.cgi b/log.cgi
index d5d2abb..8767e3a 100755 (executable)
--- a/log.cgi
+++ b/log.cgi
@@ -22,7 +22,11 @@ use FATE;
 
 my $req_slot = param 'slot';
 my $req_time = param 'time';
+$req_slot =~ s/[^-._A-Za-z0-9 ]*//g;
+$req_time =~ s/[^0-9]*//g;
 my ($req_log, $req_diff) = param('log') =~ m!([^/]+)(?:/([^/]+))?!;
+$req_log  =~ s/[^a-z]*//g;
+$req_diff =~ s/[^0-9]*//g;
 
 my $repdir = "$fatedir/$req_slot/$req_time";
 my $log = "$repdir/$req_log.log.gz";