From 01700075763c70eae061723dc4a156261f81f928 Mon Sep 17 00:00:00 2001 From: Usman Nasir Date: Wed, 5 Feb 2020 15:34:12 +0500 Subject: [PATCH] bug fix to fm after security improvements --- filemanager/filemanager.py | 2 +- filemanager/views.py | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/filemanager/filemanager.py b/filemanager/filemanager.py index ec03aa6ad..5cbdc81b6 100755 --- a/filemanager/filemanager.py +++ b/filemanager/filemanager.py @@ -365,7 +365,7 @@ class FileManager: finalData['fileName'] = fs.url(filename) pathCheck = '/home/%s' % (self.data['domainName']) - if self.data['completePath'].find(pathCheck) == -1 or self.data['completePath'].find('..') > -1: + if (self.data['completePath'] + '/' + myfile.name).find(pathCheck) == -1 or ((self.data['completePath'] + '/' + myfile.name)).find('..') > -1: return self.ajaxPre(0, 'Not allowed to move in this path, please choose location inside home!') command = 'mv ' + self.returnPathEnclosed('/home/cyberpanel/media/' + myfile.name) + ' ' + self.returnPathEnclosed(self.data['completePath'] + '/' + myfile.name) diff --git a/filemanager/views.py b/filemanager/views.py index cf89c7262..ff80052bd 100755 --- a/filemanager/views.py +++ b/filemanager/views.py @@ -59,10 +59,10 @@ def changePermissions(request): command = "sudo chown -R lscpd:lscpd /home/" + domainName+"/logs" ProcessUtilities.popenExecutioner(command) - command = "sudo find %s -type d -exec chmod 0755 {} \;" % ("/home/" + domainName + "/public_html") + command = "find %s -type d -exec chmod 0755 {} \;" % ("/home/" + domainName + "/public_html") ProcessUtilities.popenExecutioner(command) - command = "sudo find %s -type f -exec chmod 0644 {} \;" % ("/home/" + domainName + "/public_html") + command = "find %s -type f -exec chmod 0644 {} \;" % ("/home/" + domainName + "/public_html") ProcessUtilities.popenExecutioner(command) data_ret = {'permissionsChanged': 1, 'error_message': "None"}