Autres/RaspAP
1
0
Fork 0
mirror of https://github.com/billz/raspap-webgui.git synced 2025-08-01 21:49:26 +02:00
Code Issues Releases Wiki Activity

Update w/ strict check on config destination path

Browse Source
This commit is contained in:
Bill Zimmerman 2025-03-20 18:08:29 +01:00 committed by GitHub
parent 23597e800d
commit 605486feda
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
installers/plugin_helper.sh
View File

@ -71,8 +71,14 @@ case "$action" in
exit 1
fi
mkdir -p "$(dirname "$destination")"
chown -R "$raspap_user:$raspap_user" "$(dirname "$destination")"
dest_dir="$(dirname "$destination")"
if [ -z "$dest_dir" ] || [ "$dest_dir" = "/" ]; then
echo "Error: Unsafe destination path."
exit 1
fi
mkdir -p "$dest_dir"
chown -R "$raspap_user:$raspap_user" "$dest_dir"
cp "$source" "$destination"
echo "OK"