ambiser
/
btrbk
mirror of https://github.com/digint/btrbk
9
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ssh_filter_btrbk.sh: double quote variables expansions 

Double quote any variable expansions that might ever contain field separators.

Signed-off-by: Christoph Anton Mitterer <mail@christoph.anton.mitterer.name>
pull/539/head
Christoph Anton Mitterer 2022-11-15 19:55:23 +01:00 committed by Axel Burri
parent 1980c1d939
commit 5d79c012c4
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
ssh_filter_btrbk.sh
View File

@ -23,7 +23,7 @@ file_arg_match="('${file_match}'|${file_match_sane})" # support btrbk < 0.32.0
log_cmd() log_cmd()
{ {
if [[ -n "$enable_log" ]]; then if [[ -n "$enable_log" ]]; then
logger -p $1 -t ssh_filter_btrbk.sh "$2 (Name: ${LOGNAME:-<unknown>}; Remote: ${SSH_CLIENT:-<unknown>})${3:+: $3}: $SSH_ORIGINAL_COMMAND" logger -p "$1" -t ssh_filter_btrbk.sh "$2 (Name: ${LOGNAME:-<unknown>}; Remote: ${SSH_CLIENT:-<unknown>})${3:+: $3}: $SSH_ORIGINAL_COMMAND"
fi fi
} }
@ -39,7 +39,7 @@ allow_exact_cmd()
reject_and_die() reject_and_die()
{ {
local reason=$1 local reason="$1"
log_cmd 'auth.err' 'btrbk REJECT' "$reason" log_cmd 'auth.err' 'btrbk REJECT' "$reason"
echo "ERROR: ssh_filter_btrbk.sh: ssh command rejected: $reason: $SSH_ORIGINAL_COMMAND" 1>&2 echo "ERROR: ssh_filter_btrbk.sh: ssh command rejected: $reason: $SSH_ORIGINAL_COMMAND" 1>&2
exit 255 exit 255
@ -111,7 +111,7 @@ done
while [[ "$#" -ge 1 ]]; do while [[ "$#" -ge 1 ]]; do
key="$1" key="$1"
case $key in case "$key" in
-l|--log) -l|--log)
enable_log=1 enable_log=1
;; ;;
@ -177,9 +177,9 @@ allow_exact_cmd 'cat /proc/self/mountinfo' # resolve mountpoints
allow_exact_cmd 'cat /proc/self/mounts' # legacy, for btrbk < 0.27.0 allow_exact_cmd 'cat /proc/self/mounts' # legacy, for btrbk < 0.27.0
# remove leading "|" on alternation lists # remove leading "|" on alternation lists
allow_list=${allow_list#\|} allow_list="${allow_list#\|}"
allow_exact_list=${allow_exact_list#\|} allow_exact_list="${allow_exact_list#\|}"
restrict_path_list=${restrict_path_list#\|} restrict_path_list="${restrict_path_list#\|}"
case "$SSH_ORIGINAL_COMMAND" in case "$SSH_ORIGINAL_COMMAND" in
*\.\./*) reject_and_die 'directory traversal' ;; *\.\./*) reject_and_die 'directory traversal' ;;