From: msweet <msweet@a1ca3aef-8c08-0410-bb20-df032aa958be>
Date: Thu, 3 Jul 2014 14:38:52 +0000 (+0000)
Subject: Mirror fix from trunk.
X-Git-Tag: release-2.1.4~16^2~10
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=031f71f0a807444f9ca6c4b549090624f57b4cd5;p=thirdparty%2Fcups.git

Mirror fix from trunk.


git-svn-id: svn+ssh://src.apple.com/svn/cups/cups.org/branches/branch-1.7@11995 a1ca3aef-8c08-0410-bb20-df032aa958be
---

diff --git a/CHANGES.txt b/CHANGES.txt
index faac2ac9b6..d96107622d 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,8 +1,11 @@
-CHANGES.txt - 1.7.4 - 2014-07-02
+CHANGES.txt - 1.7.4 - 2014-07-03
 --------------------------------
 
 CHANGES IN CUPS V1.7.4
 
+	- Security: The web interface incorrectly served symlinked files and
+	  files that were not world-readable, potentially leading to a
+	  disclosure of information (STR #4450)
 	- The CUPS headers incorrectly needed libdispatch for blocks support
 	  (STR #4397)
 	- CUPS did not compile when Avahi or mDNSResponder was not present
diff --git a/scheduler/client.c b/scheduler/client.c
index 6f40585bc5..8037b49dd9 100644
--- a/scheduler/client.c
+++ b/scheduler/client.c
@@ -3327,7 +3327,7 @@ get_file(cupsd_client_t *con,		/* I  - Client connection */
     if ((ptr = strchr(filename, '?')) != NULL)
       *ptr = '\0';
 
-    if ((status = stat(filename, filestats)) != 0)
+    if ((status = lstat(filename, filestats)) != 0)
     {
      /*
       * Drop the language prefix and try the root directory...
@@ -3339,12 +3339,33 @@ get_file(cupsd_client_t *con,		/* I  - Client connection */
       if ((ptr = strchr(filename, '?')) != NULL)
 	*ptr = '\0';
 
-      status = stat(filename, filestats);
+      status = lstat(filename, filestats);
     }
   }
 
  /*
-  * If we're found a directory, get the index.html file instead...
+  * If we've found a symlink, 404 the sucker to avoid disclosing information.
+  */
+
+  if (!status && S_ISLNK(filestats->st_mode))
+  {
+    cupsdLogClient(con, CUPSD_LOG_INFO, "Symlinks such as \"%s\" are not allowed.", filename);
+    return (NULL);
+  }
+
+ /*
+  * Similarly, if the file/directory does not have world read permissions, do
+  * not allow access...
+  */
+
+  if (!status && !(filestats->st_mode & S_IROTH))
+  {
+    cupsdLogClient(con, CUPSD_LOG_INFO, "Files/directories such as \"%s\" must be world-readable.", filename);
+    return (NULL);
+  }
+
+ /*
+  * If we've found a directory, get the index.html file instead...
   */
 
   if (!status && S_ISDIR(filestats->st_mode))