all_string_sub() is broken as it doesn't handle mb chars correctly (and

so breaks when substitution '/' and '\'). It's used by unix_clean_name(),
which is used by reduce_name, which is used by check_name() (phew!).
Now that we know all filenames passed to check_name() are in a "good"
format (no double slashes, all '\\' chars translated to '/' etc.) due
to the new check_path_syntax() we can avoid calling reduce_name unless
widelinks are denied. After this check-in I can fix all_string_sub() to
handle mb chars correctly as it won't be in the direct path in the
main path handling code.
Jeremy.
(This used to be commit bce0678331aa4746181389e0f91f11fb2a6dadcb)

2 files changed, 5 insertions, 18 deletions

diff --git a/source3/smbd/filename.c b/source3/smbd/filename.c
index a71e8a806c..8300674d61 100644
--- a/source3/smbd/filename.c
+++ b/source3/smbd/filename.c
@@ -387,7 +387,7 @@ BOOL unix_convert(pstring name,connection_struct *conn,char *saved_last_componen
 
 BOOL check_name(pstring name,connection_struct *conn)
 {
-	BOOL ret;
+	BOOL ret = True;
 
 	errno = 0;
 
@@ -398,7 +398,9 @@ BOOL check_name(pstring name,connection_struct *conn)
 		}
 	}
 
-	ret = reduce_name(conn,name,conn->connectpath,lp_widelinks(SNUM(conn)));
+	if (!lp_widelinks(SNUM(conn))) {
+		ret = reduce_name(conn,name,conn->connectpath);
+	}
 
 	/* Check if we are allowing users to follow symlinks */
 	/* Patch from David Clerc <David.Clerc@cui.unige.ch>
diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c
index 2f981c743f..284e24e7b1 100644
--- a/source3/smbd/vfs.c
+++ b/source3/smbd/vfs.c
@@ -845,10 +845,9 @@ static BOOL readlink_check(connection_struct *conn, const char *dir, char *name)
  Reduce a file name, removing .. elements and checking that
  it is below dir in the heirachy. This uses vfs_GetWd() and so must be run
  on the system that has the referenced file system.
- Widelinks are allowed if widelinks is true.
 ********************************************************************/
 
-BOOL reduce_name(connection_struct *conn, pstring s, const char *dir,BOOL widelinks)
+BOOL reduce_name(connection_struct *conn, pstring s, const char *dir)
 {
 #ifndef REDUCE_PATHS
 	return True;
@@ -862,20 +861,6 @@ BOOL reduce_name(connection_struct *conn, pstring s, const char *dir,BOOL wideli
 
 	*dir2 = *wd = *base_name = *newname = 0;
 
-	if (widelinks) {
-		unix_clean_name(s);
-		/* can't have a leading .. */
-		if (strncmp(s,"..",2) == 0 && (s[2]==0 || s[2]=='/')) {
-			DEBUG(3,("Illegal file name? (%s)\n",s));
-			return(False);
-		}
-
-		if (strlen(s) == 0)
-			pstrcpy(s,"./");
-
-		return(True);
-	}
-
 	DEBUG(3,("reduce_name [%s] [%s]\n",s,dir));
 
 	/* remove any double slashes */