Changeset 1758

Show
Ignore:
Timestamp:
11/29/06 05:02:41 (2 years ago)
Author:
anarcat
Message:

remove quotemeta everywhere, and make sure variables are safe before using them. Closes: #1003

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • alternc/trunk/src/mail_add

    r1618 r1758  
    1414delete @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV'}; 
    1515 
    16 if (!($mailname =~ /^([a-z0-9_\+\.-]+\_[a-z0-9\.-]+)$/)) { 
     16if (!($mailname =~ /^([a-z0-9_\+\.][a-z0-9_\+\.-]+\_[a-z0-9\.-]+)$/)) { 
    1717    die "Email is incorrect."; 
    1818} 
    …… 
    3838foreach(@todo) { 
    3939    mkdir($_); 
    40     system("/bin/chown 33:$uid '".quotemeta($_)."'"); 
     40    system("/bin/chown 33:$uid '$_'"); 
    4141} 
    4242 

  • alternc/trunk/src/mail_del

    r1618 r1758  
    1414delete @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV'}; 
    1515 
    16 if (!($mailname =~ /^([a-z0-9_\+\.-]+\_[a-z0-9\.-]+)$/)) { 
     16if (!($mailname =~ /^([a-z0-9_\+-][a-z0-9_\+\.-]+\_[a-z0-9\.-]+)$/)) { 
    1717    die "Email is incorrect."; 
    1818} 
    …… 
    2222$( = $); 
    2323 
    24 system("/bin/rm -rf '".quotemeta("/var/alternc/mail/".substr($mailname,0,1)."/".$mailname)."'"); 
     24system("/bin/rm -rf '/var/alternc/mail/".substr($mailname,0,1)."/".$mailname."'"); 
    2525 
    26260; 

  • alternc/trunk/src/mem_del

    r1618 r1758  
    1414delete @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV'}; 
    1515 
    16 if (!($name =~ /^([a-z0-9_\+\.-]+)$/)) { 
     16if (!($name =~ /^([a-z0-9]+)$/)) { 
    1717    die "Account name is incorrect."; 
    1818} 
    …… 
    2424my $PTH="/var/alternc/html/".substr($name,0,1)."/".$name; 
    2525 
    26 system("/bin/rm -rf '".quotemeta($PTH)."'"); 
     26system("/bin/rm -rf '$PTH'"); 
    2727 
    28280; 

  • alternc/trunk/src/quota_edit

    r1618 r1758  
    2727$( = $); 
    2828 
    29 my $PTH="/usr/lib/alternc/quota_edit.sh '".quotemeta($uid)."' '".quotemeta($size)."'"; 
     29my $PTH="/usr/lib/alternc/quota_edit.sh '$uid' '$size'"; 
    3030 
    3131system($PTH); 

  • alternc/trunk/src/quota_get

    r1618 r1758  
    2222$( = $); 
    2323 
    24 my $PTH="/usr/lib/alternc/quota_get.sh '".quotemeta($uid)."'"; 
     24my $PTH="/usr/lib/alternc/quota_get.sh '$uid'"; 
    2525 
    2626system($PTH);