Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG  Not logged in ELOG logo
icon3.gif   [patch]: fixed wrong extention check, posted by Emiliano Gabrielli on Tue Feb 8 17:40:54 2005 
    icon2.gif   Re: [patch]: fixed wrong extention check, posted by Stefan Ritt on Sat Feb 12 17:45:39 2005 
       icon7.gif   Re: [patch]: fixed wrong extention check, posted by Emiliano Gabrielli on Wed Feb 16 08:48:52 2005 
Message ID: 925     Entry time: Tue Feb 8 17:40:54 2005     Reply to this: 934
Icon: Idea  Author: Emiliano Gabrielli  Author Email: AlberT@SuperAlberT.it 
Category: Bug fix  OS: All  ELOG Version: 2.5.6 cvs 
Subject: [patch]: fixed wrong extention check 
current version uses strstr() to check if the file has the expected ascii
text extension ... this is buggy becouse this way a file named
".txt_hidden_file" or "foo.config.dat" are both seen as .txt files.

the following patch fixes the problem, plz apply to cvs:



#######################################################################
--- elogd_orig.c        2005-02-03 16:46:10.000000000 +0100
+++ elogd_extchk_fix.c  2005-02-08 17:32:21.000000000 +0100
@@ -1160,6 +1160,28 @@

 #define my_toupper(_c)    ( ((_c)>='a' && (_c)<='z') ? ((_c)-'a'+'A') : (_c) )

+static BOOL chkext(const char *str, const char *ext)
+{
+   int extl, strl;
+   char c1, c2;
+
+   if (ext == NULL || str == NULL)
+      return FALSE;
+
+   extl = strlen(ext);
+   strl = strlen(str);
+   if (extl >= strl)
+      return FALSE;
+   str = str+strl-extl;
+   while (*str) {
+      c1 = *str++;
+      c2 = *ext++;
+      if (my_toupper(c1) != my_toupper(c2))
+         return FALSE;
+   }
+   return TRUE;
+}
+
 BOOL strieq(const char *str1, const char *str2)
 {
    char c1, c2;
@@ -1168,6 +1190,8 @@
       return TRUE;
    if (str1 == NULL || str2 == NULL)
       return FALSE;
+   if (strlen(str1)!=strlen(str2))
+      return FALSE;

    while (*str1) {
       c1 = *str1++;
@@ -13698,8 +13722,8 @@
                       ("<tr><td colspan=%d class=\"attachment\">%s %d: <a
href=\"%s\">%s</a>\n",
                        colspan, loc("Attachment"), index + 1, ref,
attachment[index] + 14);

-                  if ((strstr(str, ".TXT") || strstr(str, ".ASC") ||
strstr(str, ".CFG")
-                       || strstr(str, ".CONF")
+                  if ((chkext(str, ".TXT") || chkext(str, ".ASC") ||
chkext(str, ".CFG")
+                       || chkext(str, ".CONF")
                        || strchr(str, '.') == NULL) && show_attachments) {
                      /* display attachment */
                      rsprintf("</td></tr><tr><td colspan=%d
class=\"messagelist\"><pre>", colspan);
@@ -14779,7 +14803,7 @@
    regex_t re_buf[MAX_N_ATTR + 1];
    regmatch_t pmatch[10];

-   /* redirect if enpty parameters */
+   /* redirect if empty parameters */
    if (strstr(_cmdline, "=&")) {
       while ((pt1 = strstr(_cmdline, "=&")) != NULL) {
          pt2 = pt1;
#######################################################################
ELOG V3.1.5-fe60aaf