projects
/
project
/
luci.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (parent:
673b4e1
)
libs/web: Add additional sanity checks to session mechanism
author
Steven Barth
<steven@midlink.org>
Mon, 11 Aug 2008 10:43:31 +0000
(10:43 +0000)
committer
Steven Barth
<steven@midlink.org>
Mon, 11 Aug 2008 10:43:31 +0000
(10:43 +0000)
libs/web/luasrc/sauth.lua
patch
|
blob
|
history
diff --git
a/libs/web/luasrc/sauth.lua
b/libs/web/luasrc/sauth.lua
index
d25f287
..
8182679
100644
(file)
--- a/
libs/web/luasrc/sauth.lua
+++ b/
libs/web/luasrc/sauth.lua
@@
-45,14
+45,16
@@
end
--- Prepare session storage by creating the session directory.
function prepare()
luci.fs.mkdir(sessionpath)
--- Prepare session storage by creating the session directory.
function prepare()
luci.fs.mkdir(sessionpath)
- luci.fs.chmod(sessionpath, "a-rwx,u+rwx")
+ if not luci.fs.chmod(sessionpath, "a-rwx,u+rwx") then
+ error("Security Exception: Session path is not sane!")
+ end
end
--- Read a session and return its content.
-- @param id Session identifier
-- @return Session data
function read(id)
end
--- Read a session and return its content.
-- @param id Session identifier
-- @return Session data
function read(id)
- if not id then
+ if not id
or not sane()
then
return
end
clean()
return
end
clean()
@@
-60,11
+62,18
@@
function read(id)
end
end
+--- Check whether Session environment is sane.
+-- @return Boolean status
+function sane()
+ return luci.fs.stat(sessionpath, "mode") == "rwx------"
+end
+
+
--- Write session data to a session file.
-- @param id Session identifier
-- @param data Session data
function write(id, data)
--- Write session data to a session file.
-- @param id Session identifier
-- @param data Session data
function write(id, data)
- if not
luci.fs.stat(sessionpath
) then
+ if not
sane(
) then
prepare()
end
luci.fs.writefile(sessionpath .. "/" .. id, data)
prepare()
end
luci.fs.writefile(sessionpath .. "/" .. id, data)