Home | History | Annotate | Line # | Download | only in httpd
tilde-luzah-bozo.c revision 1.1.1.6 
      1 /*	$eterna: tilde-luzah-bozo.c,v 1.15 2010/06/15 21:43:40 mrg Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 1997-2010 Matthew R. Green
      5  * All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer and
     14  *    dedication in the documentation and/or other materials provided
     15  *    with the distribution.
     16  *
     17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
     22  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
     23  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
     24  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
     25  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     27  * SUCH DAMAGE.
     28  *
     29  */
     30 
     31 /* this code implements ~user support for bozohttpd */
     32 
     33 #ifndef NO_USER_SUPPORT
     34 
     35 #include <sys/param.h>
     36 
     37 #include <errno.h>
     38 #include <pwd.h>
     39 #include <stdlib.h>
     40 #include <string.h>
     41 #include <unistd.h>
     42 
     43 #include "bozohttpd.h"
     44 
     45 /*
     46  * bozo_user_transform does this:
     47  *	- chdir's /~user/public_html
     48  *	- returns the rest of the file, index.html appended if required
     49  *	- returned malloced file to serve in request->hr_file,
     50  *        ala transform_request().
     51  *
     52  * transform_request() is supposed to check that we have user support
     53  * enabled.
     54  */
     55 int
     56 bozo_user_transform(bozo_httpreq_t *request, int *isindex)
     57 {
     58 	bozohttpd_t *httpd = request->hr_httpd;
     59 	char	c, *s, *file = NULL;
     60 	struct	passwd *pw;
     61 
     62 	*isindex = 0;
     63 
     64 	if ((s = strchr(request->hr_file + 2, '/')) != NULL) {
     65 		*s++ = '\0';
     66 		c = s[strlen(s)-1];
     67 		*isindex = (c == '/' || c == '\0');
     68 	}
     69 
     70 	debug((httpd, DEBUG_OBESE, "looking for user %s",
     71 		request->hr_file + 2));
     72 	pw = getpwnam(request->hr_file + 2);
     73 	/* fix this up immediately */
     74 	if (s)
     75 		s[-1] = '/';
     76 	if (pw == NULL) {
     77 		(void)bozo_http_error(httpd, 404, request, "no such user");
     78 		return 0;
     79 	}
     80 
     81 	debug((httpd, DEBUG_OBESE, "user %s dir %s/%s uid %d gid %d",
     82 	      pw->pw_name, pw->pw_dir, httpd->public_html,
     83 	      pw->pw_uid, pw->pw_gid));
     84 
     85 	if (chdir(pw->pw_dir) < 0) {
     86 		bozo_warn(httpd, "chdir1 error: %s: %s", pw->pw_dir,
     87 			strerror(errno));
     88 		(void)bozo_http_error(httpd, 404, request,
     89 			"can't chdir to homedir");
     90 		return 0;
     91 	}
     92 	if (chdir(httpd->public_html) < 0) {
     93 		bozo_warn(httpd, "chdir2 error: %s: %s", httpd->public_html,
     94 			strerror(errno));
     95 		(void)bozo_http_error(httpd, 404, request,
     96 			"can't chdir to public_html");
     97 		return 0;
     98 	}
     99 	if (s == NULL || *s == '\0') {
    100 		file = bozostrdup(httpd, httpd->index_html);
    101 	} else {
    102 		file = bozomalloc(httpd, strlen(s) +
    103 		    (*isindex ? strlen(httpd->index_html) + 1 : 1));
    104 		strcpy(file, s);
    105 		if (*isindex)
    106 			strcat(file, httpd->index_html);
    107 	}
    108 
    109 	/* see transform_request() */
    110 	if (*file == '/' || strcmp(file, "..") == 0 ||
    111 	    strstr(file, "/..") || strstr(file, "../")) {
    112 		(void)bozo_http_error(httpd, 403, request, "illegal request");
    113 		free(file);
    114 		return 0;
    115 	}
    116 
    117 	if (bozo_auth_check(request, file)) {
    118 		free(file);
    119 		return 0;
    120 	}
    121 
    122 	free(request->hr_file);
    123 	request->hr_file = file;
    124 
    125 	debug((httpd, DEBUG_FAT, "transform_user returning %s under %s", file,
    126 	    pw->pw_dir));
    127 	return 1;
    128 }
    129 #endif /* NO_USER_SUPPORT */
    130