X-Git-Url: http://git.i-scream.org/?a=blobdiff_plain;f=cgi-bin%2Fdocs.cgi;h=0336e4c71b84c2fda82d3ef27e41e768fe4b42b2;hb=11eb28d0360251584579816325928658b8dc9bc2;hp=cb6c3d2bbe8dbb9fa83e81024156f0a96e7b5586;hpb=5e4357f28b692892ea28ac034c8166727ad76f06;p=www.i-scream.org.git diff --git a/cgi-bin/docs.cgi b/cgi-bin/docs.cgi index cb6c3d2..0336e4c 100755 --- a/cgi-bin/docs.cgi +++ b/cgi-bin/docs.cgi @@ -19,11 +19,26 @@ my ($bottom) = "../bottom.inc"; my ($query) = new CGI; -my ($doc) = ($query->param('doc') =~ /^\s*(.*?\.txt)\s*$/); -$doc = "../documentation/".$doc; + +# Note filenames may only have one dot in them, in the ".txt". +# This prevents malicious users using "../" to view files. +my ($doc) = ($query->param('doc') =~ /^\s*([^\.]*?\.txt)\s*$/); print "Content-type: text/html\n\n"; +unless (defined $doc) { + print "The link to this page was broken - it must specify a .txt file."; + exit; +} + +# Prevent hackers from supplying a malformed document string. +# I.e. only allow normal characters, slashes and dots. +unless ($doc =~ /^[a-zA-Z_\-0-9\.\/]+$/) { + print "Go Away, you nasty hax0r!"; + exit; +} +$doc = "../documentation/".$doc; + print <<"END"; @@ -110,5 +125,5 @@ sub print_file ($) { # Print a file without escaping HTML: - sub print_html ($) { my ($filename) = @_; - print `cat $filename`; + print `cat $filename 2>&1`; }