git724/forgejo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 4

Update go-macaron/session to latest mast to fix RCE-bug (#5177)

Browse source
This commit is contained in:
Kim "BKC" Carlbäcker 2018-10-25 13:53:39 +02:00 • committed by Lunny Xiao
parent 5f938c0c78
commit aeb5655c25
3 changed files with 23 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

12
vendor/github.com/go-macaron/session/file.go generated vendored
View file

@ -86,7 +86,7 @@ func (s *FileStore) Release() error {
return err
}
return ioutil.WriteFile(s.p.filepath(s.sid), data, os.ModePerm)
return ioutil.WriteFile(s.p.filepath(s.sid), data, 0600)
}
// Flush deletes all session data.
@ -121,7 +121,7 @@ func (p *FileProvider) filepath(sid string) string {
// Read returns raw session store by session ID.
func (p *FileProvider) Read(sid string) (_ RawStore, err error) {
filename := p.filepath(sid)
if err = os.MkdirAll(path.Dir(filename), os.ModePerm); err != nil {
if err = os.MkdirAll(path.Dir(filename), 0700); err != nil {
return nil, err
}
p.lock.RLock()
@ -129,7 +129,7 @@ func (p *FileProvider) Read(sid string) (_ RawStore, err error) {
var f *os.File
if com.IsFile(filename) {
f, err = os.OpenFile(filename, os.O_RDWR, os.ModePerm)
f, err = os.OpenFile(filename, os.O_RDONLY, 0600)
} else {
f, err = os.Create(filename)
}
@ -187,15 +187,15 @@ func (p *FileProvider) regenerate(oldsid, sid string) (err error) {
if err != nil {
return err
}
if err = os.MkdirAll(path.Dir(oldname), os.ModePerm); err != nil {
if err = os.MkdirAll(path.Dir(oldname), 0700); err != nil {
return err
}
if err = ioutil.WriteFile(oldname, data, os.ModePerm); err != nil {
if err = ioutil.WriteFile(oldname, data, 0600); err != nil {
return err
}
}
if err = os.MkdirAll(path.Dir(filename), os.ModePerm); err != nil {
if err = os.MkdirAll(path.Dir(filename), 0700); err != nil {
return err
}
if err = os.Rename(oldname, filename); err != nil {