78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
-
+
|
/*
** Check zFossil to see if it is a reasonable "fossil" command to
** run on the server. Do not allow an attacker to substitute something
** like "/bin/rm".
*/
static int is_safe_fossil_command(const char *zFossil){
static const char *azSafe[] = { "*/fossil", "*/echo" };
static const char *const azSafe[] = { "*/fossil", "*/echo" };
int i;
for(i=0; i<sizeof(azSafe)/sizeof(azSafe[0]); i++){
if( sqlite3_strglob(azSafe[i], zFossil)==0 ) return 1;
if( strcmp(azSafe[i]+2, zFossil)==0 ) return 1;
}
return 0;
}
|