Home | History | Annotate | Line # | Download | only in httpd
tilde-luzah-bozo.c revision 1.2 
      1  1.2  tls /*	$NetBSD: tilde-luzah-bozo.c,v 1.2 2007/10/17 18:48:02 tls Exp $	*/
      2  1.2  tls 
      3  1.1  tls /*	$eterna: tilde-luzah-bozo.c,v 1.4 2006/05/17 08:37:36 mrg Exp $	*/
      4  1.1  tls 
      5  1.1  tls /*
      6  1.1  tls  * Copyright (c) 1997-2006 Matthew R. Green
      7  1.1  tls  * All rights reserved.
      8  1.1  tls  *
      9  1.1  tls  * Redistribution and use in source and binary forms, with or without
     10  1.1  tls  * modification, are permitted provided that the following conditions
     11  1.1  tls  * are met:
     12  1.1  tls  * 1. Redistributions of source code must retain the above copyright
     13  1.1  tls  *    notice, this list of conditions and the following disclaimer.
     14  1.1  tls  * 2. Redistributions in binary form must reproduce the above copyright
     15  1.1  tls  *    notice, this list of conditions and the following disclaimer and
     16  1.1  tls  *    dedication in the documentation and/or other materials provided
     17  1.1  tls  *    with the distribution.
     18  1.1  tls  * 3. The name of the author may not be used to endorse or promote products
     19  1.1  tls  *    derived from this software without specific prior written permission.
     20  1.1  tls  *
     21  1.1  tls  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     22  1.1  tls  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     23  1.1  tls  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     24  1.1  tls  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     25  1.1  tls  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
     26  1.1  tls  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
     27  1.1  tls  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
     28  1.1  tls  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
     29  1.1  tls  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     30  1.1  tls  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     31  1.1  tls  * SUCH DAMAGE.
     32  1.1  tls  *
     33  1.1  tls  */
     34  1.1  tls 
     35  1.1  tls /* this code implements ~user support for bozohttpd */
     36  1.1  tls 
     37  1.1  tls #ifndef NO_USER_SUPPORT
     38  1.1  tls 
     39  1.1  tls #include <sys/param.h>
     40  1.1  tls 
     41  1.1  tls #include <errno.h>
     42  1.1  tls #include <pwd.h>
     43  1.1  tls #include <string.h>
     44  1.1  tls #include <unistd.h>
     45  1.1  tls 
     46  1.1  tls #include "bozohttpd.h"
     47  1.1  tls 
     48  1.1  tls #ifndef PUBLIC_HTML
     49  1.1  tls #define PUBLIC_HTML		"public_html"
     50  1.1  tls #endif
     51  1.1  tls 
     52  1.1  tls 	int	uflag;		/* allow /~user/ translation */
     53  1.1  tls 	const char *public_html	= PUBLIC_HTML;
     54  1.1  tls 
     55  1.1  tls /*
     56  1.1  tls  * user_transform does this:
     57  1.1  tls  *	- chdir's /~user/public_html
     58  1.1  tls  *	- returns the rest of the file, index.html appended if required
     59  1.1  tls  *
     60  1.1  tls  * transform_request() is supposed to check that we have user support
     61  1.1  tls  * enabled.
     62  1.1  tls  */
     63  1.1  tls char *
     64  1.1  tls user_transform(request, isindex)
     65  1.1  tls 	http_req *request;
     66  1.1  tls 	int *isindex;
     67  1.1  tls {
     68  1.1  tls 	char	c, *s, *file = NULL;
     69  1.1  tls 	struct	passwd *pw;
     70  1.1  tls 
     71  1.1  tls 	*isindex = 0;
     72  1.1  tls 
     73  1.1  tls 	if ((s = strchr(request->hr_url + 2, '/')) != NULL) {
     74  1.1  tls 		*s++ = '\0';
     75  1.1  tls 		c = s[strlen(s)-1];
     76  1.1  tls 		*isindex = (c == '/' || c == '\0');
     77  1.1  tls 	}
     78  1.1  tls 
     79  1.1  tls 	debug((DEBUG_OBESE, "looking for user %s", request->hr_url + 2));
     80  1.1  tls 	pw = getpwnam(request->hr_url + 2);
     81  1.1  tls 	/* fix this up immediately */
     82  1.1  tls 	if (s)
     83  1.1  tls 		s[-1] = '/';
     84  1.1  tls 	if (pw == NULL)
     85  1.1  tls 		http_error(404, request, "no such user");
     86  1.1  tls 
     87  1.1  tls 	debug((DEBUG_OBESE, "user %s home dir %s uid %d gid %d", pw->pw_name,
     88  1.1  tls 	    pw->pw_dir, pw->pw_uid, pw->pw_gid));
     89  1.1  tls 
     90  1.1  tls 	if (chdir(pw->pw_dir) < 0) {
     91  1.1  tls 		warning("chdir1 error: %s: %s", pw->pw_dir, strerror(errno));
     92  1.1  tls 		http_error(403, request, "can't chdir to homedir");
     93  1.1  tls 	}
     94  1.1  tls 	if (chdir(public_html) < 0) {
     95  1.1  tls 		warning("chdir2 error: %s: %s", public_html, strerror(errno));
     96  1.1  tls 		http_error(403, request, "can't chdir to public_html");
     97  1.1  tls 	}
     98  1.1  tls 	if (s == NULL || *s == '\0') {
     99  1.1  tls 		file = bozostrdup(index_html);
    100  1.1  tls 	} else {
    101  1.1  tls 		file = bozomalloc(strlen(s) +
    102  1.1  tls 		    (*isindex ? strlen(index_html) + 1 : 1));
    103  1.1  tls 		strcpy(file, s);
    104  1.1  tls 		if (*isindex)
    105  1.1  tls 			strcat(file, index_html);
    106  1.1  tls 	}
    107  1.1  tls 
    108  1.1  tls 	/* see transform_request() */
    109  1.1  tls 	if (*file == '/' || strcmp(file, "..") == 0 ||
    110  1.1  tls 	    strstr(file, "/..") || strstr(file, "../"))
    111  1.1  tls 		http_error(403, request, "illegal request");
    112  1.1  tls 
    113  1.1  tls 	auth_check(request, file);
    114  1.1  tls 
    115  1.1  tls 	debug((DEBUG_FAT, "transform_user returning %s under %s", file,
    116  1.1  tls 	    pw->pw_dir));
    117  1.1  tls 	return (file);
    118  1.1  tls }
    119  1.1  tls #endif /* NO_USER_SUPPORT */
    120