summaryrefslogtreecommitdiff
path: root/source3/rpc_server
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2004-06-11 17:54:23 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 10:51:56 -0500
commitfddef6fc201ed127eaac737e725d1c2dd8c6926e (patch)
tree0c8e596fbc8a4a074ecf0161f8189af5875ba876 /source3/rpc_server
parentf28e4f386393b500abfc468e390acfb808d6854a (diff)
downloadsamba-fddef6fc201ed127eaac737e725d1c2dd8c6926e.tar.gz
samba-fddef6fc201ed127eaac737e725d1c2dd8c6926e.tar.bz2
samba-fddef6fc201ed127eaac737e725d1c2dd8c6926e.zip
r1115: Fix for #1427. Catch bad path errors at the right point. Ensure all
our pathname parsing is consistent. Jeremy. (This used to be commit 5e8237e306f0bb0e492f10fb6487938132899384)
Diffstat (limited to 'source3/rpc_server')
-rw-r--r--source3/rpc_server/srv_srvsvc_nt.c24
1 files changed, 24 insertions, 0 deletions
diff --git a/source3/rpc_server/srv_srvsvc_nt.c b/source3/rpc_server/srv_srvsvc_nt.c
index 087c50451e..54cc0d6161 100644
--- a/source3/rpc_server/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srv_srvsvc_nt.c
@@ -1886,6 +1886,18 @@ WERROR _srv_net_file_query_secdesc(pipes_struct *p, SRV_Q_NET_FILE_QUERY_SECDESC
unistr2_to_ascii(filename, &q_u->uni_file_name, sizeof(filename));
unix_convert(filename, conn, NULL, &bad_path, &st);
+ if (bad_path) {
+ DEBUG(3,("_srv_net_file_query_secdesc: bad pathname %s\n", filename));
+ r_u->status = WERR_ACCESS_DENIED;
+ goto error_exit;
+ }
+
+ if (!check_name(filename,conn)) {
+ DEBUG(3,("_srv_net_file_query_secdesc: can't access %s\n", filename));
+ r_u->status = WERR_ACCESS_DENIED;
+ goto error_exit;
+ }
+
fsp = open_file_shared(conn, filename, &st, SET_DENY_MODE(DENY_NONE)|SET_OPEN_MODE(DOS_OPEN_RDONLY),
(FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), FILE_ATTRIBUTE_NORMAL, INTERNAL_OPEN_ONLY,
&access_mode, &action);
@@ -1990,6 +2002,18 @@ WERROR _srv_net_file_set_secdesc(pipes_struct *p, SRV_Q_NET_FILE_SET_SECDESC *q_
unistr2_to_ascii(filename, &q_u->uni_file_name, sizeof(filename));
unix_convert(filename, conn, NULL, &bad_path, &st);
+ if (bad_path) {
+ DEBUG(3,("_srv_net_file_set_secdesc: bad pathname %s\n", filename));
+ r_u->status = WERR_ACCESS_DENIED;
+ goto error_exit;
+ }
+
+ if (!check_name(filename,conn)) {
+ DEBUG(3,("_srv_net_file_set_secdesc: can't access %s\n", filename));
+ r_u->status = WERR_ACCESS_DENIED;
+ goto error_exit;
+ }
+
fsp = open_file_shared(conn, filename, &st, SET_DENY_MODE(DENY_NONE)|SET_OPEN_MODE(DOS_OPEN_RDWR),
(FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), FILE_ATTRIBUTE_NORMAL, INTERNAL_OPEN_ONLY,