1 /* $NetBSD: tilde-luzah-bozo.c,v 1.10 2014/01/02 08:21:38 mrg Exp $ */ 2 3 /* $eterna: tilde-luzah-bozo.c,v 1.16 2011/11/18 09:21:15 mrg Exp $ */ 4 5 /* 6 * Copyright (c) 1997-2014 Matthew R. Green 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer and 16 * dedication in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 24 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 25 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 26 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 27 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 * 31 */ 32 33 /* this code implements ~user support for bozohttpd */ 34 35 #ifndef NO_USER_SUPPORT 36 37 #include <sys/param.h> 38 39 #include <errno.h> 40 #include <pwd.h> 41 #include <stdlib.h> 42 #include <string.h> 43 #include <unistd.h> 44 45 #include "bozohttpd.h" 46 47 /* 48 * bozo_user_transform does this: 49 * - chdir's /~user/public_html 50 * - returns the rest of the file, index.html appended if required 51 * - returned malloced file to serve in request->hr_file, 52 * ala transform_request(). 53 * 54 * transform_request() is supposed to check that we have user support 55 * enabled. 56 */ 57 int 58 bozo_user_transform(bozo_httpreq_t *request, int *isindex) 59 { 60 bozohttpd_t *httpd = request->hr_httpd; 61 char c, *s, *file = NULL; 62 struct passwd *pw; 63 64 *isindex = 0; 65 66 if ((s = strchr(request->hr_file + 2, '/')) != NULL) { 67 *s++ = '\0'; 68 c = s[strlen(s)-1]; 69 *isindex = (c == '/' || c == '\0'); 70 } 71 72 debug((httpd, DEBUG_OBESE, "looking for user %s", 73 request->hr_file + 2)); 74 pw = getpwnam(request->hr_file + 2); 75 /* fix this up immediately */ 76 if (s) 77 s[-1] = '/'; 78 if (pw == NULL) { 79 (void)bozo_http_error(httpd, 404, request, "no such user"); 80 return 0; 81 } 82 83 debug((httpd, DEBUG_OBESE, "user %s dir %s/%s uid %d gid %d", 84 pw->pw_name, pw->pw_dir, httpd->public_html, 85 pw->pw_uid, pw->pw_gid)); 86 87 if (chdir(pw->pw_dir) < 0) { 88 bozo_warn(httpd, "chdir1 error: %s: %s", pw->pw_dir, 89 strerror(errno)); 90 (void)bozo_http_error(httpd, 404, request, 91 "can't chdir to homedir"); 92 return 0; 93 } 94 if (chdir(httpd->public_html) < 0) { 95 bozo_warn(httpd, "chdir2 error: %s: %s", httpd->public_html, 96 strerror(errno)); 97 (void)bozo_http_error(httpd, 404, request, 98 "can't chdir to public_html"); 99 return 0; 100 } 101 if (s == NULL || *s == '\0') { 102 file = bozostrdup(httpd, httpd->index_html); 103 } else { 104 file = bozomalloc(httpd, strlen(s) + 105 (*isindex ? strlen(httpd->index_html) + 1 : 1)); 106 strcpy(file, s); 107 if (*isindex) 108 strcat(file, httpd->index_html); 109 } 110 111 /* see transform_request() */ 112 if (*file == '/' || strcmp(file, "..") == 0 || 113 strstr(file, "/..") || strstr(file, "../")) { 114 (void)bozo_http_error(httpd, 403, request, "illegal request"); 115 free(file); 116 return 0; 117 } 118 119 if (bozo_auth_check(request, file)) { 120 free(file); 121 return 0; 122 } 123 124 free(request->hr_file); 125 request->hr_file = file; 126 127 debug((httpd, DEBUG_FAT, "transform_user returning %s under %s", file, 128 pw->pw_dir)); 129 return 1; 130 } 131 #endif /* NO_USER_SUPPORT */ 132