X-Git-Url: http://sru.miketaylor.org.uk/?a=blobdiff_plain;ds=sidebyside;f=src%2Fyaz-proxy.cpp;h=2b1afbe4c0af44bf39f2e5e8f3884bd53bb25eac;hb=cea39693ccd6467a9eb83f38a1602ee2b3fbdaee;hp=dd2bcaaee56a04d51e1029860cbe57dad68b12ad;hpb=8dfe66d56596a3eb9e5269e12929d594e8039f00;p=yazproxy-moved-to-github.git diff --git a/src/yaz-proxy.cpp b/src/yaz-proxy.cpp index dd2bcaa..2b1afbe 100644 --- a/src/yaz-proxy.cpp +++ b/src/yaz-proxy.cpp @@ -1,4 +1,4 @@ -/* $Id: yaz-proxy.cpp,v 1.16 2005-01-11 20:50:29 adam Exp $ +/* $Id: yaz-proxy.cpp,v 1.18 2005-01-18 10:49:45 adam Exp $ Copyright (c) 1998-2005, Index Data. This file is part of the yaz-proxy. @@ -691,8 +691,8 @@ int Yaz_Proxy::convert_xsl(Z_NamePlusRecordList *p, Z_APDU *apdu) void Yaz_Proxy::convert_xsl_delay() { - Z_NamePlusRecord *npr = m_stylesheet_nprl->records[m_stylesheet_offset]; #if HAVE_XSLT + Z_NamePlusRecord *npr = m_stylesheet_nprl->records[m_stylesheet_offset]; if (npr->which == Z_NamePlusRecord_databaseRecord) { Z_External *r = npr->u.databaseRecord; @@ -1895,26 +1895,35 @@ int Yaz_Proxy::file_access(Z_HTTP_Request *hreq) struct stat sbuf; if (hreq->path[0] != '/') { - yaz_log(YLOG_WARN, "Path != /"); + yaz_log(YLOG_WARN, "Bad path: %s", hreq->path); return 0; } const char *cp = hreq->path; while (*cp) { if (*cp == '/' && strchr("/.", cp[1])) + { + yaz_log(YLOG_WARN, "Bad path: %s", hreq->path); return 0; + } cp++; } const char *fname = hreq->path+1; if (stat(fname, &sbuf)) { - yaz_log(YLOG_WARN, "stat %s failed", fname); + yaz_log(YLOG_WARN|YLOG_ERRNO, "%s: stat failed", fname); return 0; } if ((sbuf.st_mode & S_IFMT) != S_IFREG) + { + yaz_log(YLOG_WARN, "%s: not a regular file", fname); return 0; + } if (sbuf.st_size > (off_t) 1000000) + { + yaz_log(YLOG_WARN, "%s: too large for transfer", fname); return 0; + } ODR o = odr_encode(); Yaz_ProxyConfig *cfg = check_reconfigure();