--- docman.php	2002/07/27 20:30:45	1.10
+++ docman.php	2002/07/28 11:39:59	1.13
@@ -118,7 +118,7 @@
 	if (file_exists("$fsDocumentRoot/docman.css")) {
 		$css=dirname($self)."/docman.css";
 	} else {
-		$css=$self."?STYLE=get&css=$css";
+		$css=$self."?STYLE=get";
 	}
 
 	include("$html/head.html");
@@ -145,6 +145,9 @@
 		$url_title="relogin";
 	}
 	include("$html/footer.html");
+
+	global $debug;
+	if ($debug) print $debug;
 } // end function EndHTML
 
 //////////////////////////////////////////////////////////////////
@@ -160,14 +163,16 @@
 
 	$exists   = file_exists($fsPath) ;
 	$ext      = strtolower(strrchr($relPath,".")) ;
-	$editable = ( $ext=="" || strstr(join(" ",$gblEditable),$ext)) ;
-	$writable = is_writeable($fsPath) ;
+	$editable = ( $ext=="" || strstr(join(" ",$gblEditable),$ext)) &&
+		check_perm($relPath,trperm_w);
+	$writable = is_writeable($fsPath) && check_perm($relPath,trperm_w) ;
+	$writable_dir = is_writeable($fsDir) && check_perm($relDir,trperm_w) ;
 	$file_lock = CheckLock($fsPath);
 
 	if (!$editable && !$exists) 
-		Error("Creation unsupported for type",$relPath) ;
-	if (!exists && !is_writeable($fsDir) )
-		Error("Creation denied",$relDir) ;
+		Error("Creation denied","Can't create <tt>$relPath</tt>") ;
+	if (!$exists && !$writable_dir )
+		Error("Creation denied","Can't write in directory <tt>$relDir</tt> while creating <tt>$relPath</tt>for which user has permissions.",1);
 
 	$text  = _("Use this page to view, modify or ") ;
 	if (is_dir($fsPath)) {
@@ -200,7 +205,7 @@
 		$fstr = htmlentities( $fstr ) ;
 ?>
 
-<FORM ACTION="<?= $self ; ?>" METHOD="POST">
+<FORM ACTION="<?= $self ?>" METHOD="POST">
 <SPAN TITLE="Click [SAVE] to store updated contents.">
 	<B>DOCUMENT CONTENTS</B>
 </SPAN><BR>
@@ -572,15 +577,16 @@
 
 	global $gblEditable, $gblIcon, $gblModDays, $webRoot, $gblHide,
 		$gblIgnoreUnknownFileType, $gblRepositoryDir,
+		$fsRealmDir, $realm, $realm_sep,
 		$HTTP_GET_VARS, $html, $realm_config;
-
+	
 	$self     = $HTTP_SERVER_VARS["PHP_SELF"] ;
 
 	if ($relDir == "") $relDir = "/";
 
 	$fsDir = $fsRoot.$relDir."/";	// current directory
 
-	if (!is_dir($fsDir)) Error("Dir not found",$relDir) ; 
+	if (!is_dir($fsDir)) Error("Dir not found",$relDir,1) ; 
 
 	$hide_items=",$gblHide,";
 
@@ -633,7 +639,7 @@
 	echo "<TABLE BORDER=0 CELLPADDING=2 
 		CELLSPACING=3 WIDTH=\"100%\">" ;
 
-	// updir bar	
+	// updir (parent) bar	
 	if (chopsl($fsDir) != chopsl($fsRoot)) {
 		$parent = dirname($relDir) ;
 		if ($parent == "") $parent = "/" ;
@@ -713,7 +719,7 @@
 			$dir = $dirList[$key];
 
 			$info_url=self_args(array("A"=>"A=E", "F"=>"F=".urlencode($dir), "D"=>$D));
-			$dir_url=$self."?D=".urlencode($relDir."/".$dir);
+			$dir_url=$self."?D=".urlencode(chopsl($relDir)."/".$dir);
 			include("$html/Navigate-dirEntry.html");
 
 		}  // iterate over dirs
@@ -860,12 +866,17 @@
 
 <?
 
-if (file_exists("$gblRepositoryDir/.info.inc")) {
+if (file_exists("$fsRealmDir/$realm".$realm_sep."info.inc")) {
+	print "<TR><TD></TD><TD COLSPAN=5>";
+	include("$fsRealmDir/$realm".$realm_sep."info.inc");
+	print "</TD></TR><TR><TD></TD><TD COLSPAN=5><HR></TD></TR>";
+} elseif (file_exists("$gblRepositoryDir/.info.inc")) {
 	print "<TR><TD></TD><TD COLSPAN=5>";
 	include("$gblRepositoryDir/.info.inc");
 	print "</TD></TR><TR><TD></TD><TD COLSPAN=5><HR></TD></TR>";
 }
 
+
 ?>
 
 <FORM METHOD="POST" ACTION="<?= $self ?>">
@@ -904,11 +915,11 @@
 // Error with sysadmin flag are reported to error_log or hidden from
 // users
 
-function Error($title,$text="",$sysadmin=0) {
+function Error($title,$text="",$sysadmin=0,$no_404=0) {
 	global $gblSeparateAdminMessages,
 		$gblMailAdminMessages,$realm,
 		$HTTP_SERVER_VARS;
-	if (! headers_sent()) header("HTTP/1.0 404 Not Found");
+	if (! headers_sent() && ! $no_404) header("HTTP/1.0 404 Not Found");
 	if ($sysadmin) {
 		if ($gblSeparateAdminMessages) {
 			$user="Your administrator ";
@@ -1206,8 +1217,8 @@
 //////////////////////////////////////////////////////////////////
 
 function chopsl($path) {
-	if (substr($path,strlen($path)-1,1) == "/") $path=substr($path,0,strlen($path)-1);
 	$path=str_replace("//","/",$path);
+	if (substr($path,strlen($path)-1,1) == "/") $path=substr($path,0,strlen($path)-1);
 	return $path;
 }
 
@@ -1432,15 +1443,17 @@
 
 function check_perm($path,$trperm) {
 	global $gblLogin,$HAVE_TRUSTEE;
-print "<br>check_perm: <tt>$path</tt> test perm ".display_trustee($perm)."<br>\n";
+
+	global $debug;
+$debug.="<br>check_perm: <tt>$path</tt> test perm ".display_trustee($perm)."<br>\n";
 	$return = ! $HAVE_TRUSTEE;
 	if ($HAVE_TRUSTEE) {
 		$perm = check_trustee($gblLogin,$path);
-print " d: $perm[deny] (".display_trustee($perm[deny]).") a: $perm[allow] (".display_trustee($perm[allow]).") perm: $trperm";
+$debug.=" d: $perm[deny] (".display_trustee($perm[deny]).") a: $perm[allow] (".display_trustee($perm[allow]).") perm: $trperm";
 		if ($perm[deny] & $trperm) $return=0;
 		elseif ($perm[allow] & $trperm) $return=1;
 	}
-print " return: $return<br>\n";
+$debug.=" return: $return<br>\n";
 	return($return);
 }
 
@@ -1470,11 +1483,25 @@
 }
 
 //////////////////////////////////////////////////////////////////
+
+// check for invalid characters in filename and dirname (.. and /)
+
+function check_dirname($file) {
+	if (strstr($file,"..")) Error("Security violation","No parent dir <tt>..</tt> allowed in directory name <tt>$file</tt>",1);
+}
+
+function check_filename($file) {
+	if (strstr($file,"..")) Error("Security violation","No parent dir <tt>..</tt> allowed in file name <tt>$file</tt>",1);
+	if (strstr($file,"/")) Error("Security violation","No slashes <tt>/</tt> allowed in file name <tt>$file</tt>",1);
+}
+
+//////////////////////////////////////////////////////////////////
 // MAIN PROGRAM
 
 	$gblFilePerms = 0640 ;         // default for new files
 	$gblDirPerms  = 0750 ;		// default for new dirs
 
+	$STYLE = $HTTP_GET_VARS[STYLE];
 	if (isset($STYLE) && $STYLE == "get") {
 		include("$html/docman.css");
 		exit;
@@ -1493,7 +1520,16 @@
 	if (! isset($fsRealmDir)) {
 		$fsRealmDir = "$gblIncDir/realm";
 	}
-	$realm_config = "$fsRealmDir/$realm.conf";
+
+	// try to add dir to script name to realm var
+	if (is_dir("$fsRealmDir/$realm/".dirname($HTTP_SERVER_VARS[SCRIPT_NAME]))) {
+		$realm .= "/".dirname($HTTP_SERVER_VARS[SCRIPT_NAME]);
+		$realm_sep = "/";
+	} else {
+		$realm_sep = ".";
+	}
+
+	$realm_config = $fsRealmDir."/".$realm.$realm_sep."conf";
 
 	// read user-defined configuration
 	if (file_exists($realm_config)) {
@@ -1529,7 +1565,7 @@
 	if (!is_dir($gblRepositoryDir)) Error("Repository dir not found","Can't find repository directory <tt>$gblRepositoryDir</tt>. Please fix that in <tt>$realm_config</tt> variable <tt>\$gblRepositoryDir</tt>.",1);
 
 	// trustee (ACL) file configuration
-	$trustee_conf="$gblIncDir/realm/$realm.trustee";
+	$trustee_conf="$fsRealmDir/$realm".$realm_sep."trustee";
 	// compiled version of trustee file
 	$trustee_php="$gblRepositoryDir/.trustee.php";
 	// get ACL informations
@@ -1550,39 +1586,49 @@
 		isset($relogin) && $secHash == $relogin) {
 		header("WWW-authenticate: basic realm=\"$realm\"") ;
 		header("HTTP/1.0 401 Unauthorized") ;
-		Error("401 Unauthorized","No trespassing !");
+		Error("401 Unauthorized","No trespassing !",0,1);
 	}
 
+
 	// read mime.types
 	readMime();
 
-	// get current directory relative to $gblFsRoot 
-	$relDir = $DIR ;	// from POST
-	if ($relDir == "") {	// not defined in POST ? 
-		$relDir = urldecode($D) ;  // then use GET
-	}	
+	if ($HTTP_SERVER_VARS["REQUEST_METHOD"] == "POST") {
+		// take variables from server
+		$FN=stripSlashes($HTTP_POST_VARS["FN"]);
+		$DIR=stripSlashes($HTTP_POST_VARS["DIR"]);
+		$RELPATH=stripSlashes($HTTP_POST_VARS["RELPATH"]);
+		$T=stripSlashes($HTTP_POST_VARS["T"]);
+		$CONFIRM=stripSlashes($HTTP_POST_VARS["CONFIRM"]);
+
+		check_filename($FN);
+		check_dirname($DIR);
+		check_dirname($RELPATH);
 
-	$relDir=stripSlashes($relDir);
+		$relDir = $DIR;
+	} else {
+		// get
+		$A=stripSlashes($HTTP_GET_VARS["A"]);
+		$D=stripSlashes(urldecode($HTTP_GET_VARS["D"]));
+		$F=stripSlashes($HTTP_GET_VARS["F"]);
 
-	if ($relDir == "/") $relDir = "" ; 	
-	// default : website root = ""
+		check_filename($F);
+		check_dirname($D);
 
-	if (strstr($relDir,"..")) Error("No updirs allowed");
+		$relDir = $D;
+	}
 
-	// full paths contain "fs" or "Fs". Paths realitve to root of
-	// website contain "rel" or "Rel". The script won't let you 
-	// edit anything above directory equal to http://server.com 
-	// i.e. below $gblFsRoot.
+	if ($relDir == "/") $relDir = "" ; 	
 
 	$relScriptDir = dirname($SCRIPT_NAME) ;  	
 	// i.e. /docman
 
 	// start on server root
 	$gblFsRoot = $gblRepositoryDir;
-	// i.e. /home/httpd/html
+	// i.e. /home/httpd/repository
 
 	$fsDir = $gblFsRoot . $relDir ; // current directory
-	if ( !is_dir($fsDir) ) Error("Dir not found",$relDir) ;
+	if ( !is_dir($fsDir) ) Error("Dir not found",$relDir,1) ;
 
 	if (isset($HTTP_SERVER_VARS["HTTPS"]) && $HTTP_SERVER_VARS["HTTPS"] == "on") {
 		$webRoot  = "https://";
@@ -1591,21 +1637,6 @@
 	}
 	$webRoot .= $HTTP_SERVER_VARS["HTTP_HOST"] . $relScriptDir;
 
-	// take variables from server
-	$FN=stripSlashes($HTTP_POST_VARS["FN"]);
-	$DIR=stripSlashes($HTTP_POST_VARS["DIR"]);
-	$RELPATH=stripSlashes($HTTP_POST_VARS["RELPATH"]);
-	$T=stripSlashes($HTTP_POST_VARS["T"]);
-	$CONFIRM=stripSlashes($HTTP_POST_VARS["CONFIRM"]);
-
-	// get
-	$A=stripSlashes($HTTP_GET_VARS["A"]);
-	$D=stripSlashes($HTTP_GET_VARS["D"]);
-
-//	if (isset($F)) Error("Document manager system error","variable $F shouldn't be set here (re-check old code)",1);
-//	$F=stripSlashes($HTTP_SERVER_VARS["PATH_INFO"]);
-	$F=stripSlashes($HTTP_GET_VARS["F"]);
-
 	switch ($HTTP_POST_VARS["POSTACTION"]) {
 	case "UPLOAD" :
 		$FN_name=stripSlashes($HTTP_POST_FILES["FN"]["tmp_name"]);
@@ -1618,8 +1649,8 @@
 		}
 
 		$FILENAME = $HTTP_POST_VARS["FILENAME"];
-		if (strstr($FILENAME,"/")) 
-			Error("Upload error","Non-conforming filename. Filename <tt>$FILENAME</tt> has slashes (<tt>/</tt>) in it.") ;
+		check_filename($FILENAME);
+
 		if (! isset($FILENAME)) { 	// from update file
 			$target = "$fsDir/".basename($FN);
 		} else {