fly/flightgear
1
0
Fork 0
Code Activity

RouteMgr security: don't allow overwriting arbitrary files

Browse source 
(the previous fix 280cd523 missed commandSaveFlightPlan)
This commit is contained in:
Rebecca N. Palmer 2017-05-11 22:21:20 +01:00
parent b80b9a8fc0
commit faf872e7f7
1 changed files with 16 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
src/Autopilot/route_mgr.cxx
View file

@ -74,7 +74,22 @@ static bool commandSaveFlightPlan(const SGPropertyNode* arg)
{ {
FGRouteMgr* self = (FGRouteMgr*) globals->get_subsystem("route-manager"); FGRouteMgr* self = (FGRouteMgr*) globals->get_subsystem("route-manager");
SGPath path = SGPath::fromUtf8(arg->getStringValue("path")); SGPath path = SGPath::fromUtf8(arg->getStringValue("path"));
return self->saveRoute(path); SGPath authorizedPath = fgValidatePath(path, true /* write */);
if (!authorizedPath.isNull()) {
return self->saveRoute(authorizedPath);
} else {
std::string msg =
"The route manager was asked to write the flightplan to '" +
path.utf8Str() + "', but this path is not authorized for writing. " +
"Please choose another location, for instance in the $FG_HOME/Export "
"folder (" + (globals->get_fg_home() / "Export").utf8Str() + ").";
SG_LOG(SG_AUTOPILOT, SG_ALERT, msg);
modalMessageBox("FlightGear", "Unable to write to the specified file",
msg);
return false;
}
} }
static bool commandActivateFlightPlan(const SGPropertyNode* arg) static bool commandActivateFlightPlan(const SGPropertyNode* arg)