# HG changeset patch
# User Ben Schmidt
# Date 1290259520 -39600
# Node ID a50b8ab11d28fdb273747073fae2187e589a3120
# Parent  edfd37c7ec4cd755605caf30cbddcc0d8ecc0c87
Validate input in php-admin to avoid altering arbitrary files
(Florian Streibelt, Morten Shearman Kirkegaard)

diff -r edfd37c7ec4c -r a50b8ab11d28 ChangeLog
--- a/ChangeLog	Fri Feb 19 03:21:55 2010 +1100
+++ b/ChangeLog	Sun Nov 21 00:25:20 2010 +1100
@@ -1,3 +1,5 @@
+ o Fixed security bug in mlmmj-php-admin (Florian Streibelt, Morten Shearman
+   Kirkegaard)
  o Added contrib/amime-receive (Gerd v. Egidy)
  o Fixed memory leak in substitute_one() (Ben Schmidt)
  o Updated German listtexts (Christoph Wilke)
diff -r edfd37c7ec4c -r a50b8ab11d28 contrib/web/php-admin/htdocs/edit.php
--- a/contrib/web/php-admin/htdocs/edit.php	Fri Feb 19 03:21:55 2010 +1100
+++ b/contrib/web/php-admin/htdocs/edit.php	Sun Nov 21 00:25:20 2010 +1100
@@ -104,6 +104,15 @@
 if(!isset($list))
 die("no list specified");
 
+if (strchr($list, "/") !== false)
+die("slash in list name");
+
+if ($list == ".")
+die("list name is dot");
+
+if ($list == "..")
+die("list name is dot-dot");
+
 if(!is_dir($topdir."/".$list))
 die("non-existent list");
 
diff -r edfd37c7ec4c -r a50b8ab11d28 contrib/web/php-admin/htdocs/save.php
--- a/contrib/web/php-admin/htdocs/save.php	Fri Feb 19 03:21:55 2010 +1100
+++ b/contrib/web/php-admin/htdocs/save.php	Sun Nov 21 00:25:20 2010 +1100
@@ -79,6 +79,15 @@
 if(!isset($list))
 die("no list specified");
 
+if (strchr($list, "/") !== false)
+die("slash in list name");
+
+if ($list == ".")
+die("list name is dot");
+
+if ($list == "..")
+die("list name is dot-dot");
+
 if(!is_dir($topdir."/".$list))
 die("non-existent list");