yesBad/pve-storage
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

upload API: safer filename handling

Browse Source 
Replace possibly-dangerous characters in uploaded filenames
with underscores, this includes spaces, colons, commas,
equal signs and any byte >= 128. Previously only spaces were
turned into underscores.

Also shell_quote the destination for scp.

Use '--' for some shell commands for safety.

Use brackets around the scp destination for ipv6 support.
This commit is contained in:
Wolfgang Bumiller
2015-08-18 13:54:06 +02:00
committed by Dietmar Maurer
parent a6f1262677
commit 53ec90e23e
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
PVE/API2/Storage/Status.pm
View File

@ -341,7 +341,7 @@ __PACKAGE__->register_method ({
chomp $filename; chomp $filename;
$filename =~ s/^.*[\/\\]//; $filename =~ s/^.*[\/\\]//;
$filename =~ s/\s/_/g; $filename =~ s/[;:,=\s\x80-\xff]/_/g;
my $path; my $path;
@ -373,7 +373,7 @@ __PACKAGE__->register_method ({
my @ssh_options = ('-o', 'BatchMode=yes'); my @ssh_options = ('-o', 'BatchMode=yes');
my @remcmd = ('/usr/bin/ssh', @ssh_options, $remip); my @remcmd = ('/usr/bin/ssh', @ssh_options, $remip, '--');
eval { eval {
# activate remote storage # activate remote storage
@ -382,14 +382,14 @@ __PACKAGE__->register_method ({
}; };
die "can't activate storage '$param->{storage}' on node '$node'\n" if $@; die "can't activate storage '$param->{storage}' on node '$node'\n" if $@;
PVE::Tools::run_command([@remcmd, '/bin/mkdir', '-p', $dirname], PVE::Tools::run_command([@remcmd, '/bin/mkdir', '-p', '--', PVE::Tools::shell_quote($dirname)],
errmsg => "mkdir failed"); errmsg => "mkdir failed");
$cmd = ['/usr/bin/scp', @ssh_options, $tmpfilename, "$remip:$dest"]; $cmd = ['/usr/bin/scp', @ssh_options, '--', $tmpfilename, "[$remip]:" . PVE::Tools::shell_quote($dest)];
} else { } else {
PVE::Storage::activate_storage($cfg, $param->{storage}); PVE::Storage::activate_storage($cfg, $param->{storage});
File::Path::make_path($dirname); File::Path::make_path($dirname);
$cmd = ['cp', $tmpfilename, $dest]; $cmd = ['cp', '--', $tmpfilename, $dest];
} }
my $worker = sub { my $worker = sub {