From bb8137062f3ea698d39ca25b86b44b9c3cc12dde Mon Sep 17 00:00:00 2001 From: Steven Barth Date: Mon, 1 Sep 2008 16:05:34 +0000 Subject: libs/web: Added several sanity checks to avoid local privilege escalation --- libs/web/luasrc/sauth.lua | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'libs/web/luasrc/sauth.lua') diff --git a/libs/web/luasrc/sauth.lua b/libs/web/luasrc/sauth.lua index 7c483119ca..0ac236753e 100644 --- a/libs/web/luasrc/sauth.lua +++ b/libs/web/luasrc/sauth.lua @@ -57,7 +57,7 @@ end -- @param id Session identifier -- @return Session data function read(id) - if not id or not sane() then + if not id or not sane(sessionpath .. "/" .. id) then return end clean() @@ -67,9 +67,11 @@ end --- Check whether Session environment is sane. -- @return Boolean status -function sane() - return luci.sys.process.info("uid") == luci.fs.stat(sessionpath, "uid") - and luci.fs.stat(sessionpath, "mode") == "rwx------" +function sane(file) + return luci.sys.process.info("uid") + == luci.fs.stat(file or sessionpath, "uid") + and luci.fs.stat(file or sessionpath, "mode") + == (file and "rw-------" or "rwx------") end -- cgit v1.2.3