Proxmox/pve-storage
5
0
Fork 0
mirror of git://git.proxmox.com/git/pve-storage.git synced 2025-02-28 01:58:06 +03:00
Code Releases Activity

upload API: safer filename handling

Browse Source 
Replace possibly-dangerous characters in uploaded filenames
with underscores, this includes spaces, colons, commas,
equal signs and any byte >= 128. Previously only spaces were
turned into underscores.

Also shell_quote the destination for scp.

Use '--' for some shell commands for safety.

Use brackets around the scp destination for ipv6 support.
This commit is contained in:
Wolfgang Bumiller 2015-08-18 13:54:06 +02:00 committed by Dietmar Maurer
parent a6f1262677
commit 53ec90e23e
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
PVE/API2/Storage/Status.pm
View File

@ -341,7 +341,7 @@ __PACKAGE__->register_method ({
chomp $filename;
$filename =~ s/^.*[\/\\]//;
$filename =~ s/\s/_/g;
$filename =~ s/[;:,=\s\x80-\xff]/_/g;
my $path;
@ -373,7 +373,7 @@ __PACKAGE__->register_method ({
my @ssh_options = ('-o', 'BatchMode=yes');
my @remcmd = ('/usr/bin/ssh', @ssh_options, $remip);
my @remcmd = ('/usr/bin/ssh', @ssh_options, $remip, '--');
eval {
# activate remote storage
@ -382,14 +382,14 @@ __PACKAGE__->register_method ({
};
die "can't activate storage '$param->{storage}' on node '$node'\n" if $@;
PVE::Tools::run_command([@remcmd, '/bin/mkdir', '-p', $dirname],
PVE::Tools::run_command([@remcmd, '/bin/mkdir', '-p', '--', PVE::Tools::shell_quote($dirname)],
errmsg => "mkdir failed");
$cmd = ['/usr/bin/scp', @ssh_options, $tmpfilename, "$remip:$dest"];
$cmd = ['/usr/bin/scp', @ssh_options, '--', $tmpfilename, "[$remip]:" . PVE::Tools::shell_quote($dest)];
} else {
PVE::Storage::activate_storage($cfg, $param->{storage});
File::Path::make_path($dirname);
$cmd = ['cp', $tmpfilename, $dest];
$cmd = ['cp', '--', $tmpfilename, $dest];
}
my $worker = sub {