livie
/
phoenix-firestorm
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MAINT-7074 Fixed ability to escape from skin directory with <icon>

meow-7.2.2
AndreyL ProductEngine 2017-04-19 21:19:04 +03:00
parent 1c5bdf4bdc
commit d4d56f004a
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
doc/contributions.txt
View File

@ -771,6 +771,8 @@ Kadah Coba
STORM-1060
STORM-1843
Jondan Lundquist
Joosten Briebers
MAINT-7074
Josef Munster
Josette Windlow
Juilan Tripsa

11
indra/llvfs/lldir.cpp
View File

@ -720,6 +720,15 @@ std::vector<std::string> LLDir::findSkinnedFilenames(const std::string& subdir,
<< ((constraint == CURRENT_SKIN)? "CURRENT_SKIN" : "ALL_SKINS")
<< LL_ENDL;
// Build results vector.
std::vector<std::string> results;
// Disallow filenames that may escape subdir
if (filename.find("..") != std::string::npos)
{
LL_WARNS("LLDir") << "Ignoring potentially relative filename '" << filename << "'" << LL_ENDL;
return results;
}
// Cache the default language directory for each subdir we've encountered.
// A cache entry whose value is the empty string means "not localized,
// don't bother checking again."
@ -784,8 +793,6 @@ std::vector<std::string> LLDir::findSkinnedFilenames(const std::string& subdir,
}
}
// Build results vector.
std::vector<std::string> results;
// The process we use depends on 'constraint'.
if (constraint != CURRENT_SKIN) // meaning ALL_SKINS
{