Public/elog
1
0
Fork 0
mirror of https://gitea.psi.ch/ELOG/elog.git synced 2026-09-08 17:13:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Disabled attachment file retrieval to prevent poxy mis-use

Browse Source
This commit is contained in:
Stefan Ritt 2024-05-03 15:50:17 +02:00
parent 3020557a2b
commit 8f942d1d18
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/elogd.cxx
View File

@ -28587,6 +28587,10 @@ void decode_post(char *logbook, LOGBOOK *lbs, char *string, const char *boundary
/* check for URL */ /* check for URL */
if (stristr(file_name, "http://") || stristr(file_name, "https://")) { if (stristr(file_name, "http://") || stristr(file_name, "https://")) {
return;
/*---- disabled for security reasons ----
// check for logbook access // check for logbook access
if (getcfg(lbs->name, "Password file", str, sizeof(str))) { if (getcfg(lbs->name, "Password file", str, sizeof(str))) {
if (!check_login(lbs, getparam("sid"))) { if (!check_login(lbs, getparam("sid"))) {
@ -28602,7 +28606,7 @@ void decode_post(char *logbook, LOGBOOK *lbs, char *string, const char *boundary
return; return;
} }
/* check for HTTP header */ // check for HTTP header
pbody = strstr(buffer, "\r\n\r\n"); pbody = strstr(buffer, "\r\n\r\n");
if (!pbody) { if (!pbody) {
show_error(loc("Invalid HTTP header")); show_error(loc("Invalid HTTP header"));
@ -28612,7 +28616,7 @@ void decode_post(char *logbook, LOGBOOK *lbs, char *string, const char *boundary
pbody += 4; pbody += 4;
header_size = pbody - buffer; header_size = pbody - buffer;
/* check for file found */ // check for file found
if (strchr(buffer, ' ')) { if (strchr(buffer, ' ')) {
status = atoi(strchr(buffer, ' ') + 1); status = atoi(strchr(buffer, ' ') + 1);
if (status != 200) { if (status != 200) {
@ -28635,6 +28639,9 @@ void decode_post(char *logbook, LOGBOOK *lbs, char *string, const char *boundary
xfree(buffer); xfree(buffer);
sprintf(str, "attachment%d", n_att++); sprintf(str, "attachment%d", n_att++);
setparam(str, full_name); setparam(str, full_name);
---- */
} else { } else {
strencode2(str2, file_name, sizeof(str2)); strencode2(str2, file_name, sizeof(str2));
sprintf(str, loc("Attachment file <b>\"%s\"</b> empty or not found"), str2); sprintf(str, loc("Attachment file <b>\"%s\"</b> empty or not found"), str2);