Hi,
as noted on irc, we should exclude .dpkg-* files, and also dot-files etc.
This is a patch to do this; please can you review,test and confirm it seems 
valid? (I don't have a way to commit on debian-apache, so please apply if it
looks good.)
-Thom
Index: src/main/http_config.c
===================================================================
RCS file: /home/cvs/apache-1.3/src/main/http_config.c,v
retrieving revision 1.168
diff -u -u -r1.168 http_config.c
--- src/main/http_config.c	16 Feb 2004 22:29:33 -0000	1.168
+++ src/main/http_config.c	8 Mar 2004 16:19:15 -0000
@@ -1164,6 +1164,31 @@
     return strcmp(f1->fname,f2->fname);
 }
 
+static int fname_valid(const char *fname) {
+    const char *c = fname;
+    char bad_dpkg[] = "*.dpkg*";
+
+    if (!isalnum(*c)) {
+        return 0;
+    }
+    ++c;
+    
+    
+    while (*c) {
+        if (!isalnum(*c) && *c!='_' && *c!='-' && *c!='.') {
+            return 0;
+        }
+        ++c;
+    }
+
+    if (!ap_fnmatch(bad_dpkg, fname, 0)) {
+        return 0;
+    }
+
+    return 1;
+}
+        
+
 CORE_EXPORT(void) ap_process_resource_config(server_rec *s, char *fname, pool *p, pool *ptemp)
 {
     const char *errmsg;
@@ -1245,7 +1270,8 @@
 	    if (strcmp(dir_entry->d_name, ".") &&
 		strcmp(dir_entry->d_name, "..") &&
                 (!ispatt ||
-                 !ap_fnmatch(pattern,dir_entry->d_name, FNM_PERIOD)) ) {
+                 !ap_fnmatch(pattern,dir_entry->d_name, FNM_PERIOD))
+                 && fname_valid(dir_entry->d_name)) {
 		fnew = (fnames *) ap_push_array(candidates);
 		fnew->fname = ap_make_full_path(p, path, dir_entry->d_name);
 	    }

Reply via email to