sysmocom/asterisk
11
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "res_stasis_recording: Allow symbolic links in configured recordings dir."

Browse source
This commit is contained in:
Jenkins2 2018-01-16 09:42:25 -06:00 committed by Gerrit Code Review
commit d677ff47ae
1 changed files with 18 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
res/stasis_recording/stored.c
View file

@ -330,6 +330,7 @@ struct stasis_app_stored_recording *stasis_app_stored_recording_find_by_name(
RAII_VAR(char *, file_with_ext, NULL, ast_free); RAII_VAR(char *, file_with_ext, NULL, ast_free);
int res; int res;
struct stat file_stat; struct stat file_stat;
int prefix_len = strlen(ast_config_AST_RECORDING_DIR);
errno = 0; errno = 0;
@ -350,18 +351,28 @@ struct stasis_app_stored_recording *stasis_app_stored_recording_find_by_name(
ast_string_field_build(recording, file, "%s/%s", dir, file); ast_string_field_build(recording, file, "%s/%s", dir, file);
if (!ast_begins_with(dir, ast_config_AST_RECORDING_DIR)) { if (!ast_begins_with(dir, ast_config_AST_RECORDING_DIR)) {
/* It's possible that one or more component of the recording path is
* a symbolic link, this would prevent dir from ever matching. */
char *real_basedir = realpath(ast_config_AST_RECORDING_DIR, NULL);
if (!real_basedir || !ast_begins_with(dir, real_basedir)) {
/* Attempt to escape the recording directory */ /* Attempt to escape the recording directory */
ast_log(LOG_WARNING, "Attempt to access invalid recording %s\n", ast_log(LOG_WARNING, "Attempt to access invalid recording directory %s\n",
name); dir);
ast_std_free(real_basedir);
errno = EACCES; errno = EACCES;
return NULL; return NULL;
} }
prefix_len = strlen(real_basedir);
ast_std_free(real_basedir);
}
/* The actual name of the recording is file with the config dir /* The actual name of the recording is file with the config dir
* prefix removed. * prefix removed.
*/ */
ast_string_field_set(recording, name, ast_string_field_set(recording, name, recording->file + prefix_len + 1);
recording->file + strlen(ast_config_AST_RECORDING_DIR) + 1);
file_with_ext = find_recording(dir, file); file_with_ext = find_recording(dir, file);
if (!file_with_ext) { if (!file_with_ext) {