Es muss sichergestellt sein, dass $form->{login} keine Datei Pfadkomponenten enthalte...

diff --git a/am.pl b/am.pl
index e48b9790d9f00672dda13f8572d0d56399213a9c..b54599e4965af4b3cb88c9ca42cda612ae851046 100755 (executable)
--- a/am.pl
+++ b/am.pl
@@ -77,6 +77,8 @@ $script =~ s/\.pl//;
 # pull in DBI
 use DBI;
 
+$form->{login} =~ s|.*/||;
+
 # check for user config file, could be missing or ???
 eval { require("$userspath/$form->{login}.conf"); };
 if ($@) {

diff --git a/login.pl b/login.pl
index 7753cc5b860393162e6f0aa68d6758b7e9eca859..7cca68aa7e1f18275815ccf0a81304d186d396b2 100755 (executable)
--- a/login.pl
+++ b/login.pl
@@ -71,6 +71,8 @@ $0 =~ tr/\\/\//;
 $pos = rindex $0, '/';
 $script = substr($0, $pos + 1);
 
+$form->{login} =~ s|.*/||;
+
 if (-e "$userspath/nologin" && $script ne 'admin.pl') {
   print "content-type: text/plain