]> git.ipfire.org Git - thirdparty/asterisk.git/commit
manager.c: Restrict ModuleLoad to the configured modules directory.
authorBen Ford <bford@digium.com>
Wed, 25 Sep 2024 18:05:58 +0000 (13:05 -0500)
committerAsterisk Development Team <asteriskteam@digium.com>
Thu, 14 Nov 2024 20:02:03 +0000 (20:02 +0000)
commitc7beb10006eb80bae51ed703e6bb2928dd5c7f5a
tree1f1f3a1df08d5003f0e543c9131e893f85eed740
parentaf05288825ae16377a2a5091929c5bfb6b1ae7df
manager.c: Restrict ModuleLoad to the configured modules directory.

When using the ModuleLoad AMI action, it was possible to traverse
upwards through the directories to files outside of the configured
modules directory. We decided it would be best to restrict access to
modules exclusively in the configured directory. You will now get an
error when the specified module is outside of this limitation.

Fixes: #897
UserNote: The ModuleLoad AMI action now restricts modules to the
configured modules directory.

(cherry picked from commit ee9a0f056e445adea2c5e5f150cd51adbb765dab)
main/manager.c