Home | History | Annotate | Line # | Download | only in httpd
tilde-luzah-bozo.c revision 1.5 
      1 /*	$NetBSD: tilde-luzah-bozo.c,v 1.5 2009/04/18 07:28:24 mrg Exp $	*/
      2 
      3 /*	$eterna: tilde-luzah-bozo.c,v 1.10 2009/04/18 05:36:04 mrg Exp $	*/
      4 
      5 /*
      6  * Copyright (c) 1997-2009 Matthew R. Green
      7  * All rights reserved.
      8  *
      9  * Redistribution and use in source and binary forms, with or without
     10  * modification, are permitted provided that the following conditions
     11  * are met:
     12  * 1. Redistributions of source code must retain the above copyright
     13  *    notice, this list of conditions and the following disclaimer.
     14  * 2. Redistributions in binary form must reproduce the above copyright
     15  *    notice, this list of conditions and the following disclaimer and
     16  *    dedication in the documentation and/or other materials provided
     17  *    with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     20  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     21  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     22  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
     24  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
     25  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
     26  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
     27  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     29  * SUCH DAMAGE.
     30  *
     31  */
     32 
     33 /* this code implements ~user support for bozohttpd */
     34 
     35 #ifndef NO_USER_SUPPORT
     36 
     37 #include <sys/param.h>
     38 
     39 #include <errno.h>
     40 #include <pwd.h>
     41 #include <stdlib.h>
     42 #include <string.h>
     43 #include <unistd.h>
     44 
     45 #include "bozohttpd.h"
     46 
     47 #ifndef PUBLIC_HTML
     48 #define PUBLIC_HTML		"public_html"
     49 #endif
     50 
     51 	int	uflag;		/* allow /~user/ translation */
     52 	const char *public_html	= PUBLIC_HTML;
     53 
     54 /*
     55  * user_transform does this:
     56  *	- chdir's /~user/public_html
     57  *	- returns the rest of the file, index.html appended if required
     58  *	- returned malloced file to serve in request->hr_file,
     59  *        ala transform_request().
     60  *
     61  * transform_request() is supposed to check that we have user support
     62  * enabled.
     63  */
     64 int
     65 user_transform(request, isindex)
     66 	http_req *request;
     67 	int *isindex;
     68 {
     69 	char	c, *s, *file = NULL;
     70 	struct	passwd *pw;
     71 
     72 	*isindex = 0;
     73 
     74 	if ((s = strchr(request->hr_file + 2, '/')) != NULL) {
     75 		*s++ = '\0';
     76 		c = s[strlen(s)-1];
     77 		*isindex = (c == '/' || c == '\0');
     78 	}
     79 
     80 	debug((DEBUG_OBESE, "looking for user %s", request->hr_file + 2));
     81 	pw = getpwnam(request->hr_file + 2);
     82 	/* fix this up immediately */
     83 	if (s)
     84 		s[-1] = '/';
     85 	if (pw == NULL) {
     86 		(void)http_error(404, request, "no such user");
     87 		return 0;
     88 	}
     89 
     90 	debug((DEBUG_OBESE, "user %s home dir %s uid %d gid %d", pw->pw_name,
     91 	    pw->pw_dir, pw->pw_uid, pw->pw_gid));
     92 
     93 	if (chdir(pw->pw_dir) < 0) {
     94 		warning("chdir1 error: %s: %s", pw->pw_dir, strerror(errno));
     95 		(void)http_error(403, request, "can't chdir to homedir");
     96 		return 0;
     97 	}
     98 	if (chdir(public_html) < 0) {
     99 		warning("chdir2 error: %s: %s", public_html, strerror(errno));
    100 		(void)http_error(403, request, "can't chdir to public_html");
    101 		return 0;
    102 	}
    103 	if (s == NULL || *s == '\0') {
    104 		file = bozostrdup(index_html);
    105 	} else {
    106 		file = bozomalloc(strlen(s) +
    107 		    (*isindex ? strlen(index_html) + 1 : 1));
    108 		strcpy(file, s);
    109 		if (*isindex)
    110 			strcat(file, index_html);
    111 	}
    112 
    113 	/* see transform_request() */
    114 	if (*file == '/' || strcmp(file, "..") == 0 ||
    115 	    strstr(file, "/..") || strstr(file, "../")) {
    116 		(void)http_error(403, request, "illegal request");
    117 		free(file);
    118 		return 0;
    119 	}
    120 
    121 	if (auth_check(request, file)) {
    122 		free(file);
    123 		return 0;
    124 	}
    125 
    126 	free(request->hr_file);
    127 	request->hr_file = file;
    128 
    129 	debug((DEBUG_FAT, "transform_user returning %s under %s", file,
    130 	    pw->pw_dir));
    131 	return 1;
    132 }
    133 #endif /* NO_USER_SUPPORT */
    134