Added path check

This commit is contained in:
Uwe Seimet 2021-09-15 10:57:12 +02:00
parent 8172c9fdfe
commit 9a8c35db6b
4 changed files with 12 additions and 6 deletions

View File

@ -29,7 +29,7 @@ Note: The command and type arguments are case insensitive. Only the first letter
.SH OPTIONS
.TP
.BR \-a\fI " "\fIFILENAME:FILESIZE
Create a disk image file with the specified name and size in bytes.
Create an image file in the default image folder with the specified name and size in bytes.
.TP
.BR \-g\fI " "\fILOG_LEVEL
Set the rascsi log level (trace, debug, info, warn, err, critical, off).

View File

@ -22,8 +22,8 @@ DESCRIPTION
OPTIONS
-a FILENAME:FILESIZE
Create a disk image file with the specified name and size in
bytes.
Create an image file in the default image folder with the speci
fied name and size in bytes.
-g LOG_LEVEL
Set the rascsi log level (trace, debug, info, warn, err, criti

View File

@ -712,10 +712,12 @@ bool CreateImage(int fd, const PbCommand& command)
}
string filename = command.params().Get(0);
if (filename[0] != '/') {
filename = default_image_folder + "/" + filename;
if (filename.find('/') != string::npos) {
return ReturnStatus(fd, false, "The image filename '" + filename + "' must not contain a path");
}
filename = default_image_folder + "/" + filename;
off_t len;
try {
len = stoul(command.params().Get(1));

View File

@ -61,8 +61,12 @@ enum PbOperation {
RESERVE = 14;
// Create an image file. The image file must not yet exist.
// PbCommand.params(0) contains the filename, PbCommand.params(1) contains the file size in bytes.
// If the filename is relative (does not start with a slash) the file is created in the default image folder.
// The filename always refers to the default image folder and must not contain a slash.
CREATE_IMAGE = 15;
// Delete an image file
// PbCommand.params(0) contains the filename.
// The filename always refers to the default image folder and must not contain a slash.
DELETE_IMAGE = 16;
}
// The properties supported by a device, helping clients to offer a good user experience