@@ -, +, @@
crafted POST to add extra lines to the log
escape the current directory
---
debian/templates/koha-conf-site.xml.in | 2 +-
misc/cronjobs/backup.sh | 6 +++++-
tools/export.pl | 11 ++++++++---
3 files changed, 14 insertions(+), 5 deletions(-)
--- a/debian/templates/koha-conf-site.xml.in
+++ a/debian/templates/koha-conf-site.xml.in
@@ -263,7 +263,7 @@
/usr/share/koha/intranet/htdocs/intranet-tmpl
/usr/share/koha/intranet/htdocs/intranet-tmpl/prog/en/includes/
/var/log/koha/__KOHASITE__
- /var/lib/koha/__KOHASITE__
+ /var/spool/koha/__KOHASITE__
--- a/misc/cronjobs/backup.sh
+++ a/misc/cronjobs/backup.sh
@@ -13,7 +13,11 @@ mysqldump --single-transaction -u koha -ppassword koha | gzip -9 > $KOHA_BACKUP
# Makes the compressed dump file property of the kohaadmin user.
# Make sure that you replace kohaadmin with a real user.
-[ -f $KOHA_BACKUP] && echo "$KOHA_BACKUP was successfully created." | mail kohaadmin -s $KOHA_BACKUP ||
+if [ -f $KOHA_BACKUP ] ; then
+echo "$KOHA_BACKUP was successfully created." | mail kohaadmin -s $KOHA_BACKUP
+else
echo "$KOHA_BACKUP was NOT successfully created." | mail kohaadmin -s $KOHA_BACKUP
+fi
+
# Notifies kohaadmin of (un)successful backup creation
# EOF
--- a/tools/export.pl
+++ a/tools/export.pl
@@ -31,6 +31,7 @@ use Data::Dumper;
my $query = new CGI;
my $op=$query->param("op") || '';
my $filename=$query->param("filename");
+$filename =~ s/(\r|\n)//;
my $dbh=C4::Context->dbh;
my $marcflavour = C4::Context->preference("marcflavour");
@@ -179,7 +180,9 @@ if ($op eq "export") {
$successful_export = download_backup( { directory => "$backupdir", extension => 'sql', filename => "$filename" } )
}
unless ( $successful_export ) {
- warn "A suspicious attempt was made to download the db at '$filename' by someone at " . $query->remote_host() . "\n";
+ my $remotehost = $query->remote_host();
+ $remotehost =~ s/(\n|\r)//;
+ warn "A suspicious attempt was made to download the db at '$filename' by someone at " . $remotehost . "\n";
}
exit;
}
@@ -189,7 +192,9 @@ if ($op eq "export") {
$successful_export = download_backup( { directory => "$backupdir", extension => 'tar', filename => "$filename" } )
}
unless ( $successful_export ) {
- warn "A suspicious attempt was made to download the configuration at '$filename' by someone at " . $query->remote_host() . "\n";
+ my $remotehost = $query->remote_host();
+ $remotehost =~ s/(\n|\r)//;
+ warn "A suspicious attempt was made to download the configuration at '$filename' by someone at " . $remotehost . "\n";
}
exit;
}
@@ -340,7 +345,7 @@ sub download_backup {
my $filename = $args->{filename};
return unless ( $directory && -d $directory );
- return unless ( $filename =~ m/$extension(\.(gz|bz2|xz))?$/ && not $filename =~ m#(^\.\.|/)# );
+ return unless ( $filename =~ m/$extension(\.(gz|bz2|xz))?$/ && not $filename =~ m#|# );
$filename = "$directory/$filename";
return unless ( -f $filename && -r $filename );
return unless ( open(my $dump, '<', $filename) );
--