Re: [PATCH 3/3] daemon: Support a --user-path option.
From: Junio C Hamano <hidden>
Date: 2016-06-15 22:42:18
Subsystem:
the rest · Maintainer:
Linus Torvalds
Possibly related (same subject, not in this thread)
- 2016-06-15 · [PATCH 3/3] daemon: Support a --user-path option. · Mark Wooding <hidden>
- 2016-06-15 · Re: [PATCH 3/3] daemon: Support a --user-path option. · Junio C Hamano <hidden>
- 2016-06-15 · Re: [PATCH 3/3] daemon: Support a --user-path option. · Mark Wooding <hidden>
- 2016-06-15 · Re: [PATCH 3/3] daemon: Support a --user-path option. · Junio C Hamano <hidden>
Junio C Hamano [off-list ref] writes:
Wouldn't loosening the "request must be absolute if you use --base-path" check in the area your first patch in the series touches to also allow paths that start with a '~' be enough?
That is, something like this is what I mean. Tested, of course ;-).
diff --git a/daemon.c b/daemon.c
index 532bb0c..324bb04 100644
--- a/daemon.c
+++ b/daemon.c@@ -145,13 +145,17 @@ static char *path_ok(char *dir) if (base_path) { static char rpath[PATH_MAX]; - if (*dir != '/') { - /* Forbid possible base-path evasion using ~paths. */ + if (!strict_paths && *dir == '~') + ; /* allow user relative paths */ + else if (*dir != '/') { + /* otherwise allow only absolute */ logerror("'%s': Non-absolute path denied (base-path active)", dir); return NULL; } - snprintf(rpath, PATH_MAX, "%s%s", base_path, dir); - dir = rpath; + else { + snprintf(rpath, PATH_MAX, "%s%s", base_path, dir); + dir = rpath; + } } path = enter_repo(dir, strict_paths);