Re: [Flightgear-devel] Nasal security

[Alan T. <ajt...@v-...>]

Still a no go I´m afraid.

Here are the error messages from your patch in the last email

nasal:5:..\..\..\src\Main\util.cxx:197:Access denied to 
C:/Users/alan/AppData/Roaming/flightgear.org

nasal:5:..\..\..\src\Main\util.cxx:197:Access denied to 
C:/Users/alan/AppData/Roaming/no.log
nasal:5:..\..\..\src\Main\util.cxx:197:Access denied to 
C:/Users/alan/AppData/Roaming/flightgear.org/no.logt
nasal:5:..\..\..\src\Main\util.cxx:197:Access denied to 
C:/Users/alan/AppData/Roaming/flightgear.org/nolog
nasal:5:..\..\..\src\Main\util.cxx:197:Access denied to 
C:/Users/alan/AppData/Roaming/flightgear.orgno.log
nasal:5:..\..\..\src\Main\util.cxx:197:Access denied to 
C:/Users/alan/AppData/Roaming/no.log
nasal:5:..\..\..\src\Main\util.cxx:197:Access denied to 
C:\Users\alan\AppData\Roaming\flightgear.org\Export/yes..gg

The situation could be a lot worse at the end of the month as Microsoft are 
making a free "upgrade" to Windows 10 available to Windows 7 and Windows 8 
users. Every new Windows release seems to involve an "improvement" to file 
security.

Alan

-----Original Message----- 
From: Rebecca N. Palmer
Sent: Monday, July 13, 2015 11:14 PM
To: fli...@li...
Subject: Re: [Flightgear-devel] Nasal security

Looks like some of the test cases in fgInitAllowedPaths() may not
actually be legal paths, which now matters since we're using realpath();
I have just pushed a possible fix, though I can't be sure since my
(64-bit Linux) system didn't have the issue.

If it still doesn't work, please recompile with this to determine
exactly what is failing:

diff --git a/src/Main/util.cxx b/src/Main/util.cxx
index 40d3244..aaaa468 100644
--- a/src/Main/util.cxx
+++ b/src/Main/util.cxx
@@ -194,6 +194,7 @@ static std::string fgValidatePath_internal
          }
      }
      // no match found
+    SG_LOG(SG_NASAL, SG_ALERT, "Access denied to " << normed_path);
      return "";
  }
  // Check whether Nasal is allowed to access a path


------------------------------------------------------------------------------
Don't Limit Your Business. Reach for the Cloud.
GigeNET's Cloud Solutions provide you with the tools and support that
you need to offload your IT needs and focus on growing your business.
Configured For All Businesses. Start Your Cloud Today.
https://www.gigenetcloud.com/
_______________________________________________
Flightgear-devel mailing list
Fli...@li...
https://lists.sourceforge.net/lists/listinfo/flightgear-devel