]>
Commit | Line | Data |
---|---|---|
fbcf52d5 JB |
1 | --- cyrus-sasl-2.1.19/lib/common.c.orig 2004-10-19 13:04:57.000000000 +0200 |
2 | +++ cyrus-sasl-2.1.19/lib/common.c 2004-10-19 13:10:34.000000000 +0200 | |
3 | @@ -1114,11 +1114,13 @@ | |
4 | _sasl_getconfpath(void *context __attribute__((unused)), | |
5 | char ** path_dest) | |
6 | { | |
7 | - char *path; | |
8 | + char *path = NULL; | |
bded92dc MM |
9 | |
10 | if (! path_dest) | |
11 | return SASL_BADPARAM; | |
fbcf52d5 | 12 | - path = getenv(SASL_CONF_PATH_ENV_VAR); |
bded92dc MM |
13 | + /* Honor external variable only in a safe environment */ |
14 | + if (getuid() == geteuid() && getgid() == getegid()) | |
fbcf52d5 | 15 | + path = getenv(SASL_CONF_PATH_ENV_VAR); |
bded92dc | 16 | if (! path) |
fbcf52d5 | 17 | path = CONFIGDIR; |
bded92dc | 18 | return _sasl_strdup(path, path_dest, NULL); |
fbcf52d5 JB |
19 | @@ -1880,7 +1882,11 @@ |
20 | if (! path) | |
21 | return SASL_BADPARAM; | |
22 | ||
23 | - *path = getenv(SASL_PATH_ENV_VAR); | |
24 | + /* Honor external variable only in a safe environment */ | |
25 | + if (getuid() == geteuid() && getgid() == getegid()) | |
26 | + *path = getenv(SASL_PATH_ENV_VAR); | |
27 | + else | |
28 | + *path = NULL; | |
29 | if (! *path) | |
30 | *path = PLUGINDIR; | |
31 |