(imap4d_login): Call imap4d_check_home_dir before switching to user's
privileges. Bail out if it returns with an error. Use util_chdir instead of chdir to change to user's home directory.
Showing
1 changed file
with
8 additions
and
3 deletions
1 | /* GNU Mailutils -- a suite of utilities for electronic mail | 1 | /* GNU Mailutils -- a suite of utilities for electronic mail |
2 | Copyright (C) 1999, 2001, 2002 Free Software Foundation, Inc. | 2 | Copyright (C) 1999, 2001, 2002, 2006 Free Software Foundation, Inc. |
3 | 3 | ||
4 | GNU Mailutils is free software; you can redistribute it and/or modify | 4 | GNU Mailutils is free software; you can redistribute it and/or modify |
5 | it under the terms of the GNU General Public License as published by | 5 | it under the terms of the GNU General Public License as published by |
... | @@ -55,11 +55,16 @@ imap4d_login (struct imap4d_command *command, char *arg) | ... | @@ -55,11 +55,16 @@ imap4d_login (struct imap4d_command *command, char *arg) |
55 | return util_finish (command, RESP_NO, "User name or passwd rejected"); | 55 | return util_finish (command, RESP_NO, "User name or passwd rejected"); |
56 | } | 56 | } |
57 | 57 | ||
58 | homedir = mu_normalize_path (strdup (auth_data->dir), "/"); | ||
59 | if (imap4d_check_home_dir (homedir, auth_data->uid, auth_data->gid)) | ||
60 | return util_finish (command, RESP_NO, | ||
61 | "User name or passwd rejected"); | ||
62 | |||
58 | if (auth_data->change_uid) | 63 | if (auth_data->change_uid) |
59 | setuid (auth_data->uid); | 64 | setuid (auth_data->uid); |
60 | 65 | ||
61 | homedir = mu_normalize_path (strdup (auth_data->dir), "/"); | 66 | util_chdir (homedir); |
62 | chdir (homedir); | 67 | |
63 | namespace_init (homedir); | 68 | namespace_init (homedir); |
64 | syslog (LOG_INFO, _("User `%s' logged in"), username); | 69 | syslog (LOG_INFO, _("User `%s' logged in"), username); |
65 | return util_finish (command, RESP_OK, "Completed"); | 70 | return util_finish (command, RESP_OK, "Completed"); | ... | ... |
-
Please register or sign in to post a comment