oss/luanti
oss/luanti
1
0
Fork 0
mirror of https://github.com/luanti-org/luanti.git synced 2025-06-27 16:36:03 +00:00
Code Wiki Activity

Fix script security path normalization in presence of links (#15481)

Browse source
This commit is contained in:
sfan5 2024-12-03 16:51:34 +01:00 • committed by GitHub
parent e9080f91f2
commit a4d1b5b155
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
7 changed files with 112 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/script/scripting_mainmenu.cpp
View file

@ -76,10 +76,11 @@ void MainMenuScripting::registerLuaClasses(lua_State *L, int top)
bool MainMenuScripting::mayModifyPath(const std::string &path)
{
if (fs::PathStartsWith(path, fs::TempPath()))
std::string path_temp = fs::AbsolutePathPartial(fs::TempPath());
if (fs::PathStartsWith(path, path_temp))
return true;
std::string path_user = fs::RemoveRelativePathComponents(porting::path_user);
std::string path_user = fs::AbsolutePathPartial(porting::path_user);
if (fs::PathStartsWith(path, path_user + DIR_DELIM "client"))
return true;
@ -92,7 +93,7 @@ bool MainMenuScripting::mayModifyPath(const std::string &path)
if (fs::PathStartsWith(path, path_user + DIR_DELIM "worlds"))
return true;
if (fs::PathStartsWith(path, fs::RemoveRelativePathComponents(porting::path_cache)))
if (fs::PathStartsWith(path, fs::AbsolutePathPartial(porting::path_cache)))
return true;
return false;