Lines 31-36
use Data::Dumper;
Link Here
|
31 |
my $query = new CGI; |
31 |
my $query = new CGI; |
32 |
my $op=$query->param("op") || ''; |
32 |
my $op=$query->param("op") || ''; |
33 |
my $filename=$query->param("filename"); |
33 |
my $filename=$query->param("filename"); |
|
|
34 |
$filename =~ s/(\r|\n)//; |
34 |
my $dbh=C4::Context->dbh; |
35 |
my $dbh=C4::Context->dbh; |
35 |
my $marcflavour = C4::Context->preference("marcflavour"); |
36 |
my $marcflavour = C4::Context->preference("marcflavour"); |
36 |
|
37 |
|
Lines 179-185
if ($op eq "export") {
Link Here
|
179 |
$successful_export = download_backup( { directory => "$backupdir", extension => 'sql', filename => "$filename" } ) |
180 |
$successful_export = download_backup( { directory => "$backupdir", extension => 'sql', filename => "$filename" } ) |
180 |
} |
181 |
} |
181 |
unless ( $successful_export ) { |
182 |
unless ( $successful_export ) { |
182 |
warn "A suspicious attempt was made to download the db at '$filename' by someone at " . $query->remote_host() . "\n"; |
183 |
my $remotehost = $query->remote_host(); |
|
|
184 |
$remotehost =~ s/(\n|\r)//; |
185 |
warn "A suspicious attempt was made to download the db at '$filename' by someone at " . $remotehost . "\n"; |
183 |
} |
186 |
} |
184 |
exit; |
187 |
exit; |
185 |
} |
188 |
} |
Lines 189-195
if ($op eq "export") {
Link Here
|
189 |
$successful_export = download_backup( { directory => "$backupdir", extension => 'tar', filename => "$filename" } ) |
192 |
$successful_export = download_backup( { directory => "$backupdir", extension => 'tar', filename => "$filename" } ) |
190 |
} |
193 |
} |
191 |
unless ( $successful_export ) { |
194 |
unless ( $successful_export ) { |
192 |
warn "A suspicious attempt was made to download the configuration at '$filename' by someone at " . $query->remote_host() . "\n"; |
195 |
my $remotehost = $query->remote_host(); |
|
|
196 |
$remotehost =~ s/(\n|\r)//; |
197 |
warn "A suspicious attempt was made to download the configuration at '$filename' by someone at " . $remotehost . "\n"; |
193 |
} |
198 |
} |
194 |
exit; |
199 |
exit; |
195 |
} |
200 |
} |
Lines 340-346
sub download_backup {
Link Here
|
340 |
my $filename = $args->{filename}; |
345 |
my $filename = $args->{filename}; |
341 |
|
346 |
|
342 |
return unless ( $directory && -d $directory ); |
347 |
return unless ( $directory && -d $directory ); |
343 |
return unless ( $filename =~ m/$extension(\.(gz|bz2|xz))?$/ && not $filename =~ m#(^\.\.|/)# ); |
348 |
return unless ( $filename =~ m/$extension(\.(gz|bz2|xz))?$/ && not $filename =~ m#|# ); |
344 |
$filename = "$directory/$filename"; |
349 |
$filename = "$directory/$filename"; |
345 |
return unless ( -f $filename && -r $filename ); |
350 |
return unless ( -f $filename && -r $filename ); |
346 |
return unless ( open(my $dump, '<', $filename) ); |
351 |
return unless ( open(my $dump, '<', $filename) ); |
347 |
- |
|
|