stjr/Kart-Public
0
0
Fork 0
mirror of https://git.do.srb2.org/KartKrew/Kart-Public.git synced 2024-12-29 05:41:02 +00:00
Code Issues Projects Releases Packages Wiki Activity

Limit file creation/manipulation to luafiles subfolder

Browse source 
Also block % in filename strings
This commit is contained in:
wolfy852 2016-01-20 22:35:53 -06:00
parent de03db99e7
commit 5579fb5240
1 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/blua/liolib.c
View file

@ -17,6 +17,9 @@
#include "lauxlib.h" #include "lauxlib.h"
#include "lualib.h" #include "lualib.h"
#include "../i_system.h"
#include "../doomdef.h"
#include "../m_misc.h"
@ -173,11 +176,14 @@ static int io_open (lua_State *L) {
} }
} }
if (strstr(filename, "..") || strchr(filename, ':') || StartsWith(filename, "\\") if (strstr(filename, "..") || strchr(filename, ':') || StartsWith(filename, "\\")
|| StartsWith(filename, "/") || !pass) || StartsWith(filename, "/") || strchr(filename, '%') || !pass)
{ {
luaL_error(L,"access denied to %s", filename); luaL_error(L,"access denied to %s", filename);
return pushresult(L,0,filename); return pushresult(L,0,filename);
} }
I_mkdir("luafiles", 0755);
char* destFilename = va("luafiles"PATHSEP"%s", filename);
filename = destFilename;
const char *mode = luaL_optstring(L, 2, "r"); const char *mode = luaL_optstring(L, 2, "r");
FILE **pf = newfile(L); FILE **pf = newfile(L);
*pf = fopen(filename, mode); *pf = fopen(filename, mode);