$fromdir / $fromfile -> $todir / $tofile\n\n"; - try_rename("$fromdir/$fromfile","$todir/$tofile"); + if (! try_rename("$fromdir/$fromfile","$todir/$tofile")) Error("Rename error","Can't rename file $fromfile to $tofile",1); try_dir("$todir/.log"); try_rename("$fromdir/.log/$fromfile","$todir/.log/$tofile"); try_dir("$todir/.note"); @@ -1203,8 +1226,8 @@ ////////////////////////////////////////////////////////////////// function chopsl($path) { - if (substr($path,strlen($path)-1,1) == "/") $path=substr($path,0,strlen($path)-1); $path=str_replace("//","/",$path); + if (substr($path,strlen($path)-1,1) == "/") $path=substr($path,0,strlen($path)-1); return $path; } @@ -1218,16 +1241,16 @@ by Vyacheslav Zavadsky */ -define(trmask_not,1 << 0); -define(trmask_clear,1 << 1); -define(trmask_deny,1 << 2); -define(trmask_one_level,1 << 3); -define(trmask_group,1 << 4); - -define(trperm_r,1 << 5); -define(trperm_w,1 << 6); -define(trperm_b,1 << 7); -define(trperm_n,1 << 8); +define('trmask_not',1 << 0); +define('trmask_clear',1 << 1); +define('trmask_deny',1 << 2); +define('trmask_one_level',1 << 3); +define('trmask_group',1 << 4); + +define('trperm_r',1 << 5); +define('trperm_w',1 << 6); +define('trperm_b',1 << 7); +define('trperm_n',1 << 8); $trustee_a2n = array( '!' => trmask_not, @@ -1275,7 +1298,7 @@ $error="".dirname($trustee_php)." must be writable by web server user"; } elseif (file_exists($trustee_php) && !is_writable($trustee_php)) { $error="trustees cache file $trustee_php exists, but is not writable by web server"; -} elseif (1 || filemtime($trustee_conf) >= filemtime($trustee_php)) { +} elseif (@filemtime($trustee_conf) >= @filemtime($trustee_php)) { $fp_php=@fopen($trustee_php,"w"); fputs($fp_php,"\n"; } } - $tr_arr[$path][$user] |= $perm; + if (isset($tr_arr[$path][$user])) { + $tr_arr[$path][$user] |= $perm; + } else { + $tr_arr[$path][$user] = $perm; + } } } } @@ -1350,10 +1377,10 @@ fclose($fp_php); } -if ($error) { +if (isset($error)) { Error("Trustee error",$error,1); } else { - include("$trustee_php"); + include_once("$trustee_php"); } return 1; @@ -1361,39 +1388,53 @@ }//init_trustee function in_group($user,$group) { - return in_array($groups[$group],$user); + global $groups; + return in_array($user,$groups[$group]); } // helper function function unroll_perm($u,$t,$user,$perm) { - // check user + + // check user FIX if ($t & trmask_not && ($u==$user)) continue; if (!($t & trmask_not) && ($u!=$user)) continue; if ($t & trmask_deny) { if ($t & trmask_clear) { - $perm[deny] &= ~$t; + $perm['deny'] &= ~$t; } else { - $perm[deny] |= $t; + $perm['deny'] |= $t; } } elseif ($t & trmask_clear) { - $perm[allow] &= ~$t; + $perm['allow'] &= ~$t; } else { - $perm[allow] |= $t; + $perm['allow'] |= $t; } return $perm; }// end of helper function function check_trustee($user,$path) { global $trustees; - $perm[allow] = 0; - $perm[deny] = 0; + $perm['allow'] = 0; + $perm['deny'] = 0; + + if (! isset($trustees)) Error("Trustees not found","Can't find in-memory trustee structure \$trustees. Probably bug in code. Contact dpavlin@rot13.org",1); + +global $debug; +$debug .= "check_trustee $path ... "; + $path_arr=explode("/",$path); - $path = "/"; + $tmppath = "/"; while (count($path_arr)) { - if (substr($path,strlen($path)-1,1) != "/") $path.="/"; - $path.=array_shift($path_arr); - $tr = $trustees[$path]; + $tmppath.=array_shift($path_arr); +$debug.= ">> $tmppath "; + + # clear one level flag + $perm['allow'] &= ~trmask_one_level; + $perm['deny'] &= ~trmask_one_level; + + if (! isset($trustees[$tmppath])) continue; + $tr = $trustees[$tmppath]; if (isset($tr)) { // first apply trustee for all @@ -1402,26 +1443,25 @@ unset($tr['*']); } // then apply group policies - foreach ($tr as $u=>$t) { - if ($t & trmask_group && in_group($user,$u)) { + foreach ($tr as $g=>$t) { + if ($t & trmask_group && in_group($user,$g)) { // resolv user $t = $t & ~trmask_group; - $u = $user; - $perm = unroll_perm($u,$t,$user, $perm); - unset($tr[$u]); + $perm = unroll_perm($user,$t,$user, $perm); + unset($tr[$g]); } } - // then apply use policy + // then apply user policy if (isset($tr[$user])) { $perm = unroll_perm($user,$tr[$user],$user, $perm); unset($tr[$user]); } - } +$debug.="d(".display_trustee($perm['deny']).") a(".display_trustee($perm['allow']).") "; } -#print "user: $user path: $path perm: "; -#print "d: $perm[deny] (".display_trustee($perm[deny]).") a: $perm[allow] (".display_trustee($perm[allow]).")\n"; +$debug.="check_trustee: user: $user path: $path==$tmppath perm: "; +$debug.="d: ".$perm['deny']." (".display_trustee($perm['deny']).") a: ".$perm['allow']." (".display_trustee($perm['allow']).")\n"; return $perm; } @@ -1429,15 +1469,18 @@ function check_perm($path,$trperm) { global $gblLogin,$HAVE_TRUSTEE; -print "check_perm: $path test perm ".display_trustee($perm)."\n"; + + global $debug; +$debug.="check_perm: on $path for perm ".display_trustee($trperm)."\n"; + $return = ! $HAVE_TRUSTEE; if ($HAVE_TRUSTEE) { $perm = check_trustee($gblLogin,$path); -print " d: $perm[deny] (".display_trustee($perm[deny]).") a: $perm[allow] (".display_trustee($perm[allow]).") perm: $trperm"; - if ($perm[deny] & $trperm) $return=0; - elseif ($perm[allow] & $trperm) $return=1; +$debug.=" d: ".$perm['deny']." (".display_trustee($perm['deny']).") a: ".$perm['allow']." (".display_trustee($perm['allow']).") perm to have: $trperm (".display_trustee($trperm).")"; + if ($perm['deny'] & $trperm) $return=0; + elseif (($perm['allow'] & $trperm) == $trperm) $return=1; } -print " return: $return\n"; +$debug.=" return: $return\n"; return($return); } @@ -1467,12 +1510,51 @@ } ////////////////////////////////////////////////////////////////// + +// check for invalid characters in filename and dirname (.. and /) + +function check_dirname($file) { + if (strstr($file,"..")) Error("Security violation","No parent dir .. allowed in directory name $file",1); +} + +function check_filename($file) { + if (strstr($file,"..")) Error("Security violation","No parent dir .. allowed in file name $file",1); + if (strstr($file,"/")) Error("Security violation","No slashes / allowed in file name $file",1); +} + +////////////////////////////////////////////////////////////////// + +// functions to move HTTP server variables to global namespace +// [replacement for register_globals in php.ini] + +function HTTP_GET_VAR($var) { + global $HTTP_GET_VARS, $GLOBALS; + if (isset($HTTP_GET_VARS[$var])) { + $GLOBALS[$var] = stripSlashes($HTTP_GET_VARS[$var]); + return $GLOBALS[$var]; + } +} + +function HTTP_POST_VAR($var) { + global $HTTP_GET_VARS, $GLOBALS; + if (isset($HTTP_GET_VARS[$var])) { + $GLOBALS[$var] = stripSlashes($HTTP_GET_VARS[$var]); + return $GLOBALS[$var]; + } +} + +////////////////////////////////////////////////////////////////// + +function Warn($text) { +} + +////////////////////////////////////////////////////////////////// // MAIN PROGRAM $gblFilePerms = 0640 ; // default for new files $gblDirPerms = 0750 ; // default for new dirs - if (isset($STYLE) && $STYLE == "get") { + if (isset($HTTP_GET_VARS["STYLE"]) && $HTTP_GET_VARS["STYLE"] == "get") { include("$html/docman.css"); exit; } @@ -1490,7 +1572,16 @@ if (! isset($fsRealmDir)) { $fsRealmDir = "$gblIncDir/realm"; } - $realm_config = "$fsRealmDir/$realm.conf"; + + // try to add dir to script name to realm var + if (is_dir("$fsRealmDir/$realm/".dirname($HTTP_SERVER_VARS["SCRIPT_NAME"]))) { + $realm .= dirname($HTTP_SERVER_VARS["SCRIPT_NAME"]); + $realm_sep = "/"; + } else { + $realm_sep = "."; + } + + $realm_config = $fsRealmDir."/".$realm.$realm_sep."conf"; // read user-defined configuration if (file_exists($realm_config)) { @@ -1508,6 +1599,10 @@ Error("Configuration error","Can't find user handling module at $gblIncDir/htusers/$gblUsers.php ! Please fix $realm_config"); } + // take additional login vars + HTTP_GET_VAR("relogin"); + HTTP_GET_VAR("force_login"); + // if no password, or empty password logout if ( isset($gblLogin) && ( @@ -1526,17 +1621,18 @@ if (!is_dir($gblRepositoryDir)) Error("Repository dir not found","Can't find repository directory $gblRepositoryDir. Please fix that in $realm_config variable \$gblRepositoryDir.",1); // trustee (ACL) file configuration - $trustee_conf="$gblIncDir/realm/$realm.trustee"; + $trustee_conf="$fsRealmDir/$realm".$realm_sep."trustee"; // compiled version of trustee file $trustee_php="$gblRepositoryDir/.trustee.php"; // get ACL informations $HAVE_TRUSTEE = init_trustee(); - if (strtolower($gblLogin) == "anonymous" || !isset($gblPasswd)) { - $perm = check_trustee($gblLogin,$path); + if (strtolower($gblLogin) == "anonymous" || !isset($gblLogin)) { + $perm = check_trustee("anonymous","/"); // browsing must be explicitly allowed for root directory // of repository for anonymous user to work! - if ($perm[allow] & trperm_b) { + if ($perm['allow'] & trperm_b) { + $gblLogin = $gblPasswd = "anonymous"; $secHash = md5($gblLogin.$gblPasswd); $gblUserName = "Anonymous user"; } @@ -1547,39 +1643,51 @@ isset($relogin) && $secHash == $relogin) { header("WWW-authenticate: basic realm=\"$realm\"") ; header("HTTP/1.0 401 Unauthorized") ; - Error("401 Unauthorized","No trespassing !"); + Error("401 Unauthorized","No trespassing !",0,1); } + // read mime.types readMime(); - // get current directory relative to $gblFsRoot - $relDir = $DIR ; // from POST - if ($relDir == "") { // not defined in POST ? - $relDir = urldecode($D) ; // then use GET - } - - $relDir=stripSlashes($relDir); - - if ($relDir == "/") $relDir = "" ; - // default : website root = "" - - if (strstr($relDir,"..")) Error("No updirs allowed"); + if ($HTTP_SERVER_VARS["REQUEST_METHOD"] == "POST") { + // take variables from server + if (HTTP_POST_VAR("FN")) check_filename($FN); + if (HTTP_POST_VAR("DIR")) { + check_dirname($DIR); + $relDir = $DIR; + } else { + trigger_error("Can't get DIR",E_USER_WARNING); + } + if (HTTP_POST_VAR("RELPATH")) check_dirname($RELPATH); + HTTP_POST_VAR("T"); + HTTP_POST_VAR("CONFIRM"); - // full paths contain "fs" or "Fs". Paths realitve to root of - // website contain "rel" or "Rel". The script won't let you - // edit anything above directory equal to http://server.com - // i.e. below $gblFsRoot. + } else { + // get + HTTP_GET_VAR("A"); + if (HTTP_GET_VAR("D")) { + check_dirname($D); + $D=urldecode($D); + $relDir = $D; + } else { + //trigger_error("Can't get D",E_USER_WARNING); + $relDir = "/"; + } + if (HTTP_GET_VAR("F")) check_filename($F); + } - $relScriptDir = dirname($SCRIPT_NAME) ; + $relScriptDir = dirname($HTTP_SERVER_VARS["SCRIPT_NAME"]) ; // i.e. /docman // start on server root $gblFsRoot = $gblRepositoryDir; - // i.e. /home/httpd/html + // i.e. /home/httpd/repository $fsDir = $gblFsRoot . $relDir ; // current directory - if ( !is_dir($fsDir) ) Error("Dir not found",$relDir) ; + if ( !is_dir($fsDir) ) Error("Dir not found","Can't find $relDir which points to $fsDir",1) ; + + if ($relDir == "") $relDir="/"; if (isset($HTTP_SERVER_VARS["HTTPS"]) && $HTTP_SERVER_VARS["HTTPS"] == "on") { $webRoot = "https://"; @@ -1588,35 +1696,22 @@ } $webRoot .= $HTTP_SERVER_VARS["HTTP_HOST"] . $relScriptDir; - // take variables from server - $FN=stripSlashes($HTTP_POST_VARS["FN"]); - $DIR=stripSlashes($HTTP_POST_VARS["DIR"]); - $RELPATH=stripSlashes($HTTP_POST_VARS["RELPATH"]); - $T=stripSlashes($HTTP_POST_VARS["T"]); - - // get - $A=stripSlashes($HTTP_GET_VARS["A"]); - $D=stripSlashes($HTTP_GET_VARS["D"]); - -// if (isset($F)) Error("Document manager system error","variable $F shouldn't be set here (re-check old code)",1); -// $F=stripSlashes($HTTP_SERVER_VARS["PATH_INFO"]); - $F=stripSlashes($HTTP_GET_VARS["F"]); - - switch ($HTTP_POST_VARS["POSTACTION"]) { + if (HTTP_POST_VAR("POSTACTION")) switch ($POSTACTION) { case "UPLOAD" : $FN_name=stripSlashes($HTTP_POST_FILES["FN"]["tmp_name"]); + $FN=stripSlashes($HTTP_POST_FILES["FN"]["name"]); if (!is_writeable($fsDir)) Error("Write denied",$relDir) ; - if (strstr($FN_name,"/")) - Error("Non-conforming filename") ; - // TODO : should rather check for escapeshellcmds - // but maybe RFC 18xx asserts safe filenames .... + $source = $FN_name ; if (! file_exists($source)) { Error("You must select file with browse to upload it!"); } + $FILENAME = $HTTP_POST_VARS["FILENAME"]; + check_filename($FILENAME); + if (! isset($FILENAME)) { // from update file - $target = "$fsDir/$FN_name" ; + $target = "$fsDir/".basename($FN); } else { $target = "$fsDir/$FILENAME"; } @@ -1749,11 +1844,13 @@ case "RENAME" : if ( $CONFIRM != "on" ) break ; + $NEWNAME=stripSlashes($HTTP_POST_VARS["NEWNAME"]); LogIt("$fsDir/$FN","renamed $FN to $NEWNAME",trperm_r); safe_rename($fsDir,$FN,$NEWNAME); break ; case "NOTE" : + $NOTE=stripSlashes($HTTP_POST_VARS["NOTE"]); WriteNote("$fsDir/$FN","$NOTE"); break ; @@ -1767,7 +1864,7 @@ } // common to all POSTs : redirect to directory view ($relDir) - if ( $POSTACTION != "" ) { + if (isset($POSTACTION)) { $tstr = $PHP_SELF . "?D=" . urlencode($relDir) ; header("Location: " . $tstr) ; exit ; @@ -1780,14 +1877,16 @@ // $A=Co : checkout file $D/$F // $A=Ci : checkin file $D/$F // $A=V : view file (do nothing except log) - // $A=I : include file .$F.php from $gblFsRoot + // $A=I : include file .$F.php from [$gblIncDir|realm]/include_php // default : display directory $D - switch ($A) { + if (isset($A)) switch ($A) { case "U" : // upload to $relDir + if (! check_perm($relDir, trperm_w)) + Error("Write access denied","You don't have permission to write in $relDir"); if (!is_writeable($gblFsRoot . $relDir)) - Error("Write access denied",$relDir) ; + Error("Write access denied","User $gblLogin has permission on $relDir, but directory is not writable",1); $text = "Use this page to upload a single " ; $text .= "file to $realm." ; StartHTML("(Upload Page)", $text) ; @@ -1835,11 +1934,14 @@ EndHTML() ; exit; case "I" : - $F=stripSlashes($F); - $inc_file="${gblFsRoot}/.${F}.php"; - if (!isset($F) || $F == "" || !file_exists($inc_file)) Error("Fatal error $inc_file"); // can't find file to include + if (! isset($F) || $F == "") + Error("Can't find file to include","Your request didn't specify file to include which should be in variable F like $HTTP_SERVER_VARS[REQUEST_URI]&F=include_php_file",1); + $inc_file="$fsRealmDir/$realm".$realm_sep.$F.".php"; + if (! file_exists($inc_file)) { + Error("Can't find file to include","Can't find include file $F.php in $fsRealmDir/$realm/. Meybe you should copy $gblIncDir/include_php/$F.php to $inc_file ?",1); + } if (!is_readable($inc_file)) - Error("Read access to include file denied",".${F}.php"); + Error("Read access to include file denied","Can't read PHP include file $inc_file. Fix permissions on it.",1); $text = "Your include file should define \$text variable which holds this text and \$title variable which is page title"; $title = "You should define \$title variable with page title"; include($inc_file);