--- loncom/lond	2016/09/21 05:39:53	1.528
+++ loncom/lond	2016/09/24 15:35:25	1.529
@@ -2,7 +2,7 @@
 # The LearningOnline Network
 # lond "LON Daemon" Server (port "LOND" 5663)
 #
-# $Id: lond,v 1.528 2016/09/21 05:39:53 raeburn Exp $
+# $Id: lond,v 1.529 2016/09/24 15:35:25 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -64,7 +64,7 @@ my $DEBUG = 0;		       # Non zero to ena
 my $status='';
 my $lastlog='';
 
-my $VERSION='$Revision: 1.528 $'; #' stupid emacs
+my $VERSION='$Revision: 1.529 $'; #' stupid emacs
 my $remoteVERSION;
 my $currenthostid="default";
 my $currentdomainid;
@@ -1568,6 +1568,20 @@ sub du2_handler {
 #    selected directory the filename followed by the full output of
 #    the stat function is returned.  The returned info for each
 #    file are separated by ':'.  The stat fields are separated by &'s.
+#
+#    If the requested path contains /../ or is:
+#
+#    1. for a directory, and the path does not begin with one of:
+#        (a) /home/httpd/html/res/<domain>/
+#        (b) /home/httpd/html/res/userfiles/
+#        (c) /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/userfiles
+#    or is:
+#
+#    2. for a file, and the path (after prepending) does not begin with:
+#    /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/
+#
+#    the response will be "refused".
+#
 # Parameters:
 #    $cmd        - The command that dispatched us (ls).
 #    $ulsdir     - The directory path to list... I'm not sure what this
@@ -1589,8 +1603,17 @@ sub ls_handler {
     my $rights;
     my $ulsout='';
     my $ulsfn;
+    if ($ulsdir =~m{/\.\./}) {
+        &Failure($client,"refused\n",$userinput);
+        return 1;
+    }
     if (-e $ulsdir) {
 	if(-d $ulsdir) {
+            unless (($ulsdir =~ m{/home/httpd/html/(res/$LONCAPA::match_domain|userfiles)/}) ||
+                    ($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/userfiles/})) {
+                &Failure($client,"refused\n",$userinput);
+                return 1;
+            }
 	    if (opendir(LSDIR,$ulsdir)) {
 		while ($ulsfn=readdir(LSDIR)) {
 		    undef($obs);
@@ -1614,6 +1637,10 @@ sub ls_handler {
 		closedir(LSDIR);
 	    }
 	} else {
+            unless ($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/}) {
+                &Failure($client,"refused\n",$userinput);
+                return 1;
+            }
 	    my @ulsstats=stat($ulsdir);
 	    $ulsout.=$ulsfn.'&'.join('&',@ulsstats).':';
 	}
@@ -1638,6 +1665,20 @@ sub ls_handler {
 #    selected directory the filename followed by the full output of
 #    the stat function is returned.  The returned info for each
 #    file are separated by ':'.  The stat fields are separated by &'s.
+#
+#    If the requested path contains /../ or is:
+#
+#    1. for a directory, and the path does not begin with one of:
+#        (a) /home/httpd/html/res/<domain>/
+#        (b) /home/httpd/html/res/userfiles/
+#        (c) /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/userfiles
+#    or is:
+#
+#    2. for a file, and the path (after prepending) does not begin with:
+#    /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/
+#
+#    the response will be "refused".
+#
 # Parameters:
 #    $cmd        - The command that dispatched us (ls).
 #    $ulsdir     - The directory path to list... I'm not sure what this
@@ -1658,8 +1699,17 @@ sub ls2_handler {
     my $rights;
     my $ulsout='';
     my $ulsfn;
+    if ($ulsdir =~m{/\.\./}) {
+        &Failure($client,"refused\n",$userinput);
+        return 1;
+    }
     if (-e $ulsdir) {
         if(-d $ulsdir) {
+            unless (($ulsdir =~ m{/home/httpd/html/(res/$LONCAPA::match_domain|userfiles)/}) ||
+                    ($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/userfiles/})) {
+                &Failure($client,"refused\n","$userinput");
+                return 1;
+            }
             if (opendir(LSDIR,$ulsdir)) {
                 while ($ulsfn=readdir(LSDIR)) {
                     undef($obs);
@@ -1684,6 +1734,10 @@ sub ls2_handler {
                 closedir(LSDIR);
             }
         } else {
+            unless ($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/}) {
+                &Failure($client,"refused\n",$userinput);
+                return 1;
+            }
             my @ulsstats=stat($ulsdir);
             $ulsout.=$ulsfn.'&'.join('&',@ulsstats).':';
         }
@@ -1700,6 +1754,22 @@ sub ls2_handler {
 #    selected directory the filename followed by the full output of
 #    the stat function is returned.  The returned info for each
 #    file are separated by ':'.  The stat fields are separated by &'s.
+#
+#    If the requested path (after prepending) contains /../ or is:
+#
+#    1. for a directory, and the path does not begin with one of:
+#        (a) /home/httpd/html/res/<domain>/
+#        (b) /home/httpd/html/res/userfiles/
+#        (c) /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/userfiles
+#        (d) /home/httpd/html/priv/<domain>/ and client is the homeserver
+#
+#    or is: 
+#
+#    2. for a file, and the path (after prepending) does not begin with:
+#    /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/
+#
+#    the response will be "refused".
+#
 # Parameters:
 #    $cmd        - The command that dispatched us (ls).
 #    $tail       - The tail of the request that invoked us.
@@ -1739,22 +1809,12 @@ sub ls3_handler {
     }
 
     my $dir_root = $perlvar{'lonDocRoot'};
-    if ($getpropath) {
+    if (($getpropath) || ($getuserdir)) {
         if (($uname =~ /^$LONCAPA::match_name$/) && ($udom =~ /^$LONCAPA::match_domain$/)) {
             $dir_root = &propath($udom,$uname);
             $dir_root =~ s/\/$//;
         } else {
-            &Failure($client,"refused\n","$cmd:$tail");
-            return 1;
-        }
-    } elsif ($getuserdir) {
-        if (($uname =~ /^$LONCAPA::match_name$/) && ($udom =~ /^$LONCAPA::match_domain$/)) {
-            my $subdir=$uname.'__';
-            $subdir =~ s/(.)(.)(.).*/$1\/$2\/$3/;
-            $dir_root = $Apache::lonnet::perlvar{'lonUsersDir'}
-                       ."/$udom/$subdir/$uname";
-        } else {
-            &Failure($client,"refused\n","$cmd:$tail");
+            &Failure($client,"refused\n",$userinput);
             return 1;
         }
     } elsif ($alternate_root ne '') {
@@ -1767,12 +1827,28 @@ sub ls3_handler {
             $ulsdir = $dir_root.'/'.$ulsdir;
         }
     }
+    if ($ulsdir =~m{/\.\./}) {
+        &Failure($client,"refused\n",$userinput);
+        return 1;
+    }
+    my $islocal;
+    my @machine_ids = &Apache::lonnet::current_machine_ids();
+    if (grep(/^\Q$clientname\E$/,@machine_ids)) {
+        $islocal = 1;
+    }
     my $obs;
     my $rights;
     my $ulsout='';
     my $ulsfn;
     if (-e $ulsdir) {
         if(-d $ulsdir) {
+            unless (($getpropath) || ($getuserdir) ||
+                    ($ulsdir =~ m{/home/httpd/html/(res/$LONCAPA::match_domain|userfiles)/}) ||
+                    ($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/userfiles/}) ||
+                    (($ulsdir =~ m{/home/httpd/html/priv/$LONCAPA::match_domain/}) && ($islocal))) {
+                &Failure($client,"refused\n",$userinput);
+                return 1;
+            }
             if (opendir(LSDIR,$ulsdir)) {
                 while ($ulsfn=readdir(LSDIR)) {
                     undef($obs);
@@ -1797,6 +1873,11 @@ sub ls3_handler {
                 closedir(LSDIR);
             }
         } else {
+            unless (($getpropath) || ($getuserdir) ||
+                    ($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/})) {
+                &Failure($client,"refused\n",$userinput);
+                return 1;
+            }
             my @ulsstats=stat($ulsdir);
             $ulsout.=$ulsfn.'&'.join('&',@ulsstats).':';
         }