kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-11-02 03:48:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge "res_stasis_recording: Allow symbolic links in configured recordings dir."

Browse Source
This commit is contained in:
Jenkins2
2018-01-16 09:42:25 -06:00
committed by Gerrit Code Review
parent 9cfdb81e91 de7f2a6cb4
commit d677ff47ae
1 changed files with 18 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
res/stasis_recording/stored.c
View File

@@ -330,6 +330,7 @@ struct stasis_app_stored_recording *stasis_app_stored_recording_find_by_name(
RAII_VAR(char *, file_with_ext, NULL, ast_free); RAII_VAR(char *, file_with_ext, NULL, ast_free);
int res; int res;
struct stat file_stat; struct stat file_stat;
int prefix_len = strlen(ast_config_AST_RECORDING_DIR);
errno = 0; errno = 0;
@@ -350,18 +351,28 @@ struct stasis_app_stored_recording *stasis_app_stored_recording_find_by_name(
ast_string_field_build(recording, file, "%s/%s", dir, file); ast_string_field_build(recording, file, "%s/%s", dir, file);
if (!ast_begins_with(dir, ast_config_AST_RECORDING_DIR)) { if (!ast_begins_with(dir, ast_config_AST_RECORDING_DIR)) {
/* Attempt to escape the recording directory */ /* It's possible that one or more component of the recording path is
ast_log(LOG_WARNING, "Attempt to access invalid recording %s\n", * a symbolic link, this would prevent dir from ever matching. */
name); char *real_basedir = realpath(ast_config_AST_RECORDING_DIR, NULL);
errno = EACCES;
return NULL; if (!real_basedir || !ast_begins_with(dir, real_basedir)) {
/* Attempt to escape the recording directory */
ast_log(LOG_WARNING, "Attempt to access invalid recording directory %s\n",
dir);
ast_std_free(real_basedir);
errno = EACCES;
return NULL;
}
prefix_len = strlen(real_basedir);
ast_std_free(real_basedir);
} }
/* The actual name of the recording is file with the config dir /* The actual name of the recording is file with the config dir
* prefix removed. * prefix removed.
*/ */
ast_string_field_set(recording, name, ast_string_field_set(recording, name, recording->file + prefix_len + 1);
recording->file + strlen(ast_config_AST_RECORDING_DIR) + 1);
file_with_ext = find_recording(dir, file); file_with_ext = find_recording(dir, file);
if (!file_with_ext) { if (!file_with_ext) {