mirror
/
galene
mirror of https://github.com/jech/galene.git
1
Fork 0
Code

Don't allow group names to start with a period.

This commit is contained in:
Juliusz Chroboczek 2021-10-28 20:01:11 +02:00
parent d440cdf898
commit 8c21ede9d2
3 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
README.PROTOCOL
View File

@ -24,8 +24,8 @@ message types.
### Group ### Group
A group is a set of clients. It is identified by a human-readable name A group is a set of clients. It is identified by a human-readable name
that must not start or end with a slash "`/`" and must not have the that must not start or end with a slash "`/`", must not start with
substrings "`/../`" or "`/./`". a period "`.`", and must not contain the substrings "`/../`" or "`/./`".
### Client ### Client

5
group/group.go
View File

@ -1085,6 +1085,11 @@ func Update() {
) )
return nil return nil
} }
base := filepath.Base(filename)
if base[0] == '.' {
log.Printf("Group file %v ignored", filename)
return nil
}
name := filename[:len(filename)-5] name := filename[:len(filename)-5]
desc, err := GetDescription(name) desc, err := GetDescription(name)
if err != nil { if err != nil {

4
webserver/webserver.go
View File

@ -262,6 +262,10 @@ func parseGroupName(prefix string, p string) string {
return "" return ""
} }
if name[0] == '.' {
return ""
}
if filepath.Separator != '/' && if filepath.Separator != '/' &&
strings.ContainsRune(name, filepath.Separator) { strings.ContainsRune(name, filepath.Separator) {
return "" return ""