File 0002-Ensure-that-upload-paths-are-children-of-t... of Package pgadmin4

Overview Repositories Revisions Requests Users Attributes Meta

File 0002-Ensure-that-upload-paths-are-children-of-the-storage-directory.patch of Package pgadmin4 (Revision 0560fa5e3edaf13efffb4f371a5d0943)

Currently displaying revision 0560fa5e3edaf13efffb4f371a5d0943 , Show latest

From dccd4f0bbaafa783d9f0360c7592b128d5cc3928 Mon Sep 17 00:00:00 2001
From: Akshay Joshi <akshay.joshi@enterprisedb.com>
Date: Fri, 11 Mar 2022 18:20:16 +0530
Subject: [PATCH] Ensure that upload paths are children of the storage
 directory. Fixes #7233

---
 docs/en_US/release_notes_6_7.rst          | 20 ++++++++++++--------
 web/pgadmin/misc/file_manager/__init__.py |  6 +++++-
 2 files changed, 17 insertions(+), 9 deletions(-)

#diff --git a/docs/en_US/release_notes_6_7.rst b/docs/en_US/release_notes_6_7.rst
#index 68dd11dc2..12ba2718c 100644
#--- a/docs/en_US/release_notes_6_7.rst
#+++ b/docs/en_US/release_notes_6_7.rst
#@@ -2,21 +2,25 @@
# Version 6.7
# ************
# 
#-Release date: 2022-03-11
#+Release date: 2022-03-14
# 
# This release contains a number of bug fixes and new features since the release of pgAdmin4 6.6.
# 
#-New features
#-************
#+.. note::  **Security Release**
# 
#+    Please note that this release includes a security update to fix an issue
#+    where a user could upload files to directories outside of their storage directory, when using pgAdmin
#+    running in server mode.
# 
#-Housekeeping
#-************
#+    Users running pgAdmin in server mode, including the standard container based distribution, should upgrade
#+    to this release as soon as possible.
# 
#+    This issue does not affect users running in desktop mode.
# 
# Bug fixes
# *********
# 
#-| `Issue #7220 <https://redmine.postgresql.org/issues/7220>`_ -  Fixed a schema diff issue where difference SQL isn't generated when foreign key values for a table differ.
#-| `Issue #7228 <https://redmine.postgresql.org/issues/7228>`_ -  Fixed a schema diff issue where string separator '_$PGADMIN$_' is visible for identical user mappings.
#-| `Issue #7230 <https://redmine.postgresql.org/issues/7230>`_ -  Fixed an issue where pgAdmin 4 took ~75 seconds to display the 'Starting pgAdmin' text on the splash screen.
#+  | `Issue #7220 <https://redmine.postgresql.org/issues/7220>`_ -  Fixed a schema diff issue where difference SQL isn't generated when foreign key values for a table differ.
#+  | `Issue #7228 <https://redmine.postgresql.org/issues/7228>`_ -  Fixed a schema diff issue where string separator '_$PGADMIN$_' is visible for identical user mappings.
#+  | `Issue #7230 <https://redmine.postgresql.org/issues/7230>`_ -  Fixed an issue where pgAdmin 4 took ~75 seconds to display the 'Starting pgAdmin' text on the splash screen.
#+  | `Issue #7233 <https://redmine.postgresql.org/issues/7233>`_ -  Ensure that upload paths are children of the storage directory.
diff --git a/web/pgadmin/misc/file_manager/__init__.py b/web/pgadmin/misc/file_manager/__init__.py
index d132e46eb..9df8ccc41 100644
--- a/web/pgadmin/misc/file_manager/__init__.py
+++ b/web/pgadmin/misc/file_manager/__init__.py
@@ -985,7 +985,11 @@ def add(self, req=None):
             try:
                 # Check if the new file is inside the users directory
                 if config.SERVER_MODE:
-                    pathlib.Path(new_name).relative_to(the_dir)
+                    pathlib.Path(
+                        os.path.abspath(
+                            os.path.join(the_dir, new_name)
+                        )
+                    ).relative_to(the_dir)
             except ValueError as _:
                 return self.ERROR_NOT_ALLOWED

Places

File 0002-Ensure-that-upload-paths-are-children-of-the-storage-directory.patch of Package pgadmin4 (Revision 0560fa5e3edaf13efffb4f371a5d0943)

Places