Author: cazfi
Date: Thu Mar  3 18:40:52 2016
New Revision: 32172

URL: http://svn.gna.org/viewcvs/freeciv?rev=32172&view=rev
Log:
When loading savagame, first check savefile with the exact name given in server 
command line, and
only then try different savegame suffices for it. For filenames given by other 
means than command
line adding one of the extensions is still required, to protect against loading 
arbitrary files.

See bug #23872

Modified:
    branches/S2_5/server/srv_main.c
    branches/S2_5/server/stdinhand.c
    branches/S2_5/server/stdinhand.h

Modified: branches/S2_5/server/srv_main.c
URL: 
http://svn.gna.org/viewcvs/freeciv/branches/S2_5/server/srv_main.c?rev=32172&r1=32171&r2=32172&view=diff
==============================================================================
--- branches/S2_5/server/srv_main.c     (original)
+++ branches/S2_5/server/srv_main.c     Thu Mar  3 18:40:52 2016
@@ -2562,7 +2562,7 @@
 
   /* load a saved game */
   if ('\0' == srvarg.load_filename[0]
-   || !load_command(NULL, srvarg.load_filename, FALSE)) {
+      || !load_command(NULL, srvarg.load_filename, FALSE, TRUE)) {
     /* Rulesets are loaded on game initialization, but may be changed later
      * if /load or /rulesetdir is done. */
     load_rulesets(NULL, TRUE);
@@ -2570,7 +2570,7 @@
 
   maybe_automatic_meta_message(default_meta_message_string());
 
-  if(!(srvarg.metaserver_no_send)) {
+  if (!(srvarg.metaserver_no_send)) {
     log_normal(_("Sending info to metaserver <%s>."), meta_addr_port());
     /* Open socket for meta server */
     if (!server_open_meta()

Modified: branches/S2_5/server/stdinhand.c
URL: 
http://svn.gna.org/viewcvs/freeciv/branches/S2_5/server/stdinhand.c?rev=32172&r1=32171&r2=32172&view=diff
==============================================================================
--- branches/S2_5/server/stdinhand.c    (original)
+++ branches/S2_5/server/stdinhand.c    Thu Mar  3 18:40:52 2016
@@ -3635,9 +3635,10 @@
     legitimate but has inconsistencies) and would lead to a broken server
     afterwards.
 **************************************************************************/
-bool load_command(struct connection *caller, const char *filename, bool check)
-{
-  struct timer *loadtimer, *uloadtimer;  
+bool load_command(struct connection *caller, const char *filename, bool check,
+                  bool cmdline_load)
+{
+  struct timer *loadtimer, *uloadtimer;
   struct section_file *file;
   char arg[MAX_LEN_PATH];
   struct conn_list *global_observers;
@@ -3672,10 +3673,26 @@
     const char **ext, *found = NULL;
     const struct strvec **path;
 
+    if (cmdline_load) {
+      /* Allow plain names being loaded with '--file' option, but not otherwise
+       * (no loading of arbitrary files by unauthorized users)
+       * Iterate through ALL paths to check for file with plain name before
+       * looking any path with an extension, i.e., prefer plain name file
+       * in later directory over file with extension in name in earlier
+       * directory. */
+      for (path = pathes; !found && *path; path++) {
+        found = fileinfoname(*path, filename);
+        if (found != NULL) {
+          sz_strlcpy(arg, found);
+        }
+      }
+    }
+
     for (path = pathes; !found && *path; path++) {
       for (ext = exts; !found && *ext; ext++) {
         fc_snprintf(testfile, sizeof(testfile), "%s.%s", filename, *ext);
-        if ((found = fileinfoname(*path, testfile))) {
+        found = fileinfoname(*path, testfile);
+        if (found != NULL) {
           sz_strlcpy(arg, found);
         }
       }
@@ -4293,7 +4310,7 @@
     return scensave_command(caller, arg, check);
 #endif
   case CMD_LOAD:
-    return load_command(caller, arg, check);
+    return load_command(caller, arg, check, FALSE);
   case CMD_METAPATCHES:
     return metapatches_command(caller, arg, check);
   case CMD_METAMESSAGE:

Modified: branches/S2_5/server/stdinhand.h
URL: 
http://svn.gna.org/viewcvs/freeciv/branches/S2_5/server/stdinhand.h?rev=32172&r1=32171&r2=32172&view=diff
==============================================================================
--- branches/S2_5/server/stdinhand.h    (original)
+++ branches/S2_5/server/stdinhand.h    Thu Mar  3 18:40:52 2016
@@ -1,4 +1,4 @@
-/********************************************************************** 
+/**********************************************************************
  Freeciv - Copyright (C) 1996 - A Kjeldberg, L Gregersen, P Unold
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -52,7 +52,7 @@
                                        char *buf, size_t buflen);
 
 bool load_command(struct connection *caller,
-                 const char *filename, bool check);
+                  const char *filename, bool check, bool cmdline_load);
 bool start_command(struct connection *caller, bool check, bool notify);
 
 void toggle_ai_player_direct(struct connection *caller,


_______________________________________________
Freeciv-commits mailing list
Freeciv-commits@gna.org
https://mail.gna.org/listinfo/freeciv-commits

Reply via email to