.AppleDxxx folders were user accessible if option 'usedots' was set

diff --git a/NEWS b/NEWS
index a43fbf753110043921cf73fbce4a0e7fab1c3710..0d728beae66399c0d01345927345daeb8e0b875f 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,8 @@ Changes in 2.0.5
 ================
 
 * FIX: papd: Remove variable expansion for BSD printers. Fixes CVE-2008-5718.
+* FIX: afpd: .AppleDxxx folders were user accessible if option 'usedots'
+       was set 
 
 Changes in 2.0.4
 ================

diff --git a/etc/afpd/directory.c b/etc/afpd/directory.c
index fb4d7d52bd18f6d630e44c9f10d1ab3e30de510f..4f28340671e3590852dea188f5a7446e2773f10e 100644 (file)
--- a/etc/afpd/directory.c
+++ b/etc/afpd/directory.c
@@ -1,5 +1,5 @@
 /*
- * $Id: directory.c,v 1.71.2.4.2.15.2.11 2009-01-28 05:37:57 didg Exp $
+ * $Id: directory.c,v 1.71.2.4.2.15.2.12 2009-07-20 18:29:56 didg Exp $
  *
  * Copyright (c) 1990,1993 Regents of The University of Michigan.
  * All Rights Reserved.  See COPYRIGHT.
@@ -569,6 +569,13 @@ struct path *path;
         afp_errno = AFPERR_PARAM;
         return NULL;
     }
+
+    if (check_name(vol, path->u_name)) {
+        /* the name is illegal */
+        afp_errno = AFPERR_PARAM;
+        return NULL;
+    }
+
     if (of_stat( path ) != 0 ) {
         return( NULL );
     }
@@ -2004,9 +2011,6 @@ int       ibuflen _U_, *rbuflen;
         return AFPERR_EXIST;
 
     upath = s_path->u_name;
-    if (0 != (err = check_name(vol, upath))) {
-       return err;
-    }
 
     if (AFP_OK != (err = netatalk_mkdir( upath))) {
         return err;

diff --git a/etc/afpd/file.c b/etc/afpd/file.c
index 7d3baec396c9dc52cc5ce43ea8ce45bd3e5c74c7..e99b6d79521a0388ad2a387d6cadeb0b06d28f1d 100644 (file)
--- a/etc/afpd/file.c
+++ b/etc/afpd/file.c
@@ -1,5 +1,5 @@
 /*
- * $Id: file.c,v 1.92.2.2.2.31.2.23 2008-12-23 09:39:02 didg Exp $
+ * $Id: file.c,v 1.92.2.2.2.31.2.24 2009-07-20 18:29:56 didg Exp $
  *
  * Copyright (c) 1990,1993 Regents of The University of Michigan.
  * All Rights Reserved.  See COPYRIGHT.
@@ -595,7 +595,6 @@ int ibuflen _U_, *rbuflen;
     char               *path, *upath;
     int                        creatf, did, openf, retvalue = AFP_OK;
     u_int16_t          vid;
-    int                 ret;
     struct path                *s_path;
     
 #ifdef DEBUG
@@ -632,8 +631,6 @@ int ibuflen _U_, *rbuflen;
     }
 
     upath = s_path->u_name;
-    if (0 != (ret = check_name(vol, upath))) 
-       return  ret;
     
     /* if upath is deleted we already in trouble anyway */
     if ((of = of_findname(s_path))) {