Es muss sichergestellt sein, dass $form->{login} keine Datei Pfadkomponenten enthalte...

diff --git a/am.pl b/am.pl
index e48b979..b54599e 100755 (executable)
--- a/am.pl
+++ b/am.pl
@@ -77,6 +77,8 @@ $script =~ s/\.pl//;
 # pull in DBI
 use DBI;
 
+$form->{login} =~ s|.*/||;
+
 # check for user config file, could be missing or ???
 eval { require("$userspath/$form->{login}.conf"); };
 if ($@) {

diff --git a/login.pl b/login.pl
index 7753cc5..7cca68a 100755 (executable)
--- a/login.pl
+++ b/login.pl
@@ -71,6 +71,8 @@ $0 =~ tr/\\/\//;
 $pos = rindex $0, '/';
 $script = substr($0, $pos + 1);
 
+$form->{login} =~ s|.*/||;
+
 if (-e "$userspath/nologin" && $script ne 'admin.pl') {
   print "content-type: text/plain