octoleo
/
telegram-bot-bash
mirror of https://github.com/octoleo/telegram-bot-bash.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

fix checkUploadFile

This commit is contained in:
Kay Marquardt (Gnadelwartz) 2021-02-17 10:20:45 +01:00
parent b1e6e0fc50
commit 473d802aab
3 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
bashbot.sh
View File

@ -30,7 +30,7 @@ BOTCOMMANDS="-h help init start stop status suspendback resumeback killb
# 8 - curl/wget missing # 8 - curl/wget missing
# 10 - not bash! # 10 - not bash!
# #
#### $$VERSION$$ v1.45-dev-26-g82a57a7 #### $$VERSION$$ v1.45-dev-34-gb1e6e0f
################################################################## ##################################################################
# are we running in a terminal? # are we running in a terminal?
@ -515,8 +515,8 @@ UPLOADDIR="${BASHBOT_UPLOAD:-${DATADIR}/upload}"
# return final file name or empty string on error # return final file name or empty string on error
checkUploadFile() { checkUploadFile() {
local err file="$2" local err file="$2"
[[ "${file}" = *'..'* || "${file}" = '.'* ]] && err=1 # no directory traversal [[ "${file}" == *'..'* || "${file}" == '.'* ]] && err=1 # no directory traversal
if [[ "${file}" = '/'* ]] ; then if [[ "${file}" == '/'* ]] ; then
[[ ! "${file}" =~ ${FILE_REGEX} ]] && err=2 # absolute must match REGEX [[ ! "${file}" =~ ${FILE_REGEX} ]] && err=2 # absolute must match REGEX
else else
file="${UPLOADDIR:-NOUPLOADDIR}/${file}" # others must be in UPLOADDIR file="${UPLOADDIR:-NOUPLOADDIR}/${file}" # others must be in UPLOADDIR
@ -537,6 +537,7 @@ checkUploadFile() {
[ -n "${BASHBOTDEBUG}" ] && log_debug "$3: CHAT=$1 FILE=$2 MSG=${BOTSENT[DESCRIPTION]}" [ -n "${BASHBOTDEBUG}" ] && log_debug "$3: CHAT=$1 FILE=$2 MSG=${BOTSENT[DESCRIPTION]}"
return 1 return 1
fi fi
printf "%s\n" "${file}"
} }

2
dev/all-tests.sh
View File

@ -5,7 +5,7 @@
# #
# Description: run all tests, exit after failed test # Description: run all tests, exit after failed test
# #
#### $$VERSION$$ v1.45-dev-21-ge67e43d #### $$VERSION$$ v1.45-dev-34-gb1e6e0f
############################################################# #############################################################
#shellcheck disable=SC1090 #shellcheck disable=SC1090

2
test/d-send_message-test.sh
View File

@ -10,7 +10,7 @@
# LICENSE: WTFPLv2 http://www.wtfpl.net/txt/copying/ # LICENSE: WTFPLv2 http://www.wtfpl.net/txt/copying/
# AUTHOR: KayM (gnadelwartz), kay@rrr.de # AUTHOR: KayM (gnadelwartz), kay@rrr.de
# #
#### $$VERSION$$ v1.40-0-gf9dab50 #### $$VERSION$$ v1.45-dev-34-gb1e6e0f
#=============================================================================== #===============================================================================
# include common functions and definitions # include common functions and definitions